CVE-2022-4117
Published: 26 December 2022
Summary
CVE-2022-4117 is a critical-severity an unspecified weakness vulnerability in Iws-Geo-Form-Fields Project Iws-Geo-Form-Fields. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The IWS WordPress plugin through version 1.0 contains an unauthenticated SQL injection vulnerability. The flaw stems from improper escaping of a parameter used in a SQL statement within an AJAX action that is reachable without authentication, allowing direct manipulation of database queries.
An unauthenticated attacker can invoke the affected AJAX endpoint over the network to inject arbitrary SQL, resulting in full compromise of confidentiality, integrity, and availability on the target site as reflected by the CVSS 9.8 rating.
The vulnerability is documented in WPScan advisories at the referenced URLs, which identify the affected plugin versions and recommend updating or removing the plugin to eliminate the exposed AJAX action.
EPSS for this CVE rose from a low baseline after disclosure to a peak of 0.8354 in December 2025 before receding to the current value of 0.6081, indicating later-emerging exploitation interest that warrants renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-51484
Vulnerability details
The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.