CVE-2022-0949
Published: 11 April 2022
Summary
CVE-2022-0949 is a critical-severity SQL Injection (CWE-89) vulnerability in Stopbadbots Block And Stop Bad Bots. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before version 6.930 contains a SQL injection vulnerability (CWE-89) tracked as CVE-2022-0949. The flaw stems from insufficient sanitization and escaping of the fingerprint parameter passed to the stopbadbots_grava_fingerprint AJAX action, which is reachable without authentication and directly incorporated into a SQL statement.
Unauthenticated remote attackers can supply a crafted fingerprint value to execute arbitrary SQL queries. With a CVSS score of 9.8, successful exploitation can result in full read, write, and delete access to the WordPress database, enabling theft of credentials, content manipulation, or further site compromise.
The referenced WPScan advisory identifies the issue in versions prior to 6.930 and indicates that updating the plugin to 6.930 or later resolves the injection by correcting parameter handling.
EPSS scores reaching a peak of 0.6914 and remaining at 0.6245 reflect sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15963
Vulnerability details
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action,…
more
available to unauthenticated users, leading to a SQL injection
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.