Cyber Resilience

CVE-2023-28662

CriticalPublic PoC

Published: 22 March 2023

Published
22 March 2023
Modified
25 February 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.7425 98.9th percentile
Risk Priority 64 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-28662 is a critical-severity SQL Injection (CWE-89) vulnerability in Codemenschen Gift Vouchers. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The Gift Cards (Gift Vouchers and Packages) WordPress plugin, in versions up to and including 4.3.1, contains an unauthenticated SQL injection vulnerability (CWE-89) in the template parameter processed by the wpgv_doajax_voucher_pdf_save_func action. The flaw carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack complexity that is low with no required credentials or user interaction.

An unauthenticated attacker can supply a malicious template value to the affected AJAX handler and execute arbitrary SQL queries against the underlying database, resulting in full compromise of confidentiality, integrity, and availability of the WordPress site and its data.

The referenced Tenable research note (TRA-2023-2) provides further technical detail on the issue. The associated EPSS score reached a peak of 0.8389 and currently stands at 0.7425, indicating sustained exploitation interest after public disclosure.

EU & UK References

Vulnerability details

The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

codemenschen
gift vouchers
≤ 4.3.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References