CVE-2023-28662
Published: 22 March 2023
Summary
CVE-2023-28662 is a critical-severity SQL Injection (CWE-89) vulnerability in Codemenschen Gift Vouchers. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Gift Cards (Gift Vouchers and Packages) WordPress plugin, in versions up to and including 4.3.1, contains an unauthenticated SQL injection vulnerability (CWE-89) in the template parameter processed by the wpgv_doajax_voucher_pdf_save_func action. The flaw carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack complexity that is low with no required credentials or user interaction.
An unauthenticated attacker can supply a malicious template value to the affected AJAX handler and execute arbitrary SQL queries against the underlying database, resulting in full compromise of confidentiality, integrity, and availability of the WordPress site and its data.
The referenced Tenable research note (TRA-2023-2) provides further technical detail on the issue. The associated EPSS score reached a peak of 0.8389 and currently stands at 0.7425, indicating sustained exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32323
Vulnerability details
The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.