CVE-2022-1057
Published: 11 July 2022
Summary
CVE-2022-1057 is a critical-severity SQL Injection (CWE-89) vulnerability in Varktech Pricing Deals For Woocommerce. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Pricing Deals for WooCommerce WordPress plugin through version 2.0.2.02 contains an unauthenticated SQL injection vulnerability tracked as CVE-2022-1057. The flaw stems from insufficient sanitization and escaping of a parameter passed to a SQL statement inside an AJAX action exposed to unauthenticated users, corresponding to CWE-89 and carrying a CVSS 3.1 score of 9.8.
An attacker with no credentials can invoke the affected AJAX endpoint to inject arbitrary SQL, enabling full read/write access to the database and potentially leading to complete compromise of the confidentiality, integrity, and availability of the WordPress site and its WooCommerce data.
The supplied references point to a WPScan advisory entry but contain no explicit mitigation details such as patch versions or configuration changes. The associated EPSS score stands at 0.6477 with an identical peak value, indicating sustained exploitation interest without a documented low-to-high trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-24403
Vulnerability details
The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.