CVE-2022-4059
Published: 02 January 2023
Summary
CVE-2022-4059 is a critical-severity SQL Injection (CWE-89) vulnerability in Blocksera Cryptocurrency Widgets Pack. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Cryptocurrency Widgets Pack WordPress plugin before version 2.0 contains a SQL injection vulnerability tracked as CVE-2022-4059. The root cause is a failure to sanitize and escape a parameter before it is incorporated into a SQL statement executed through an AJAX action exposed to all users.
Unauthenticated attackers can reach the vulnerable endpoint over the network with no user interaction required. Successful exploitation grants full read, write, and delete access to the database, corresponding to the CVSS 9.8 rating that reflects high impact across confidentiality, integrity, and availability.
The issue was publicly documented in WPScan vulnerability reports that identify the affected plugin versions and the specific AJAX action involved.
EPSS probability rose from a low baseline to a peak of 0.8246 on 2025-12-11 before receding to the current value of 0.5656, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-51436
Vulnerability details
The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.