CVE-2023-7337
Published: 04 March 2026
Summary
CVE-2023-7337 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Other Platforms; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL injection in version 2.8.2 via the 'js-support-ticket-token-tkstatus' cookie. The flaw stems from an incomplete remediation of CVE-2023-50839 that left a second code sink with insufficient escaping of user-supplied values and inadequate parameterization of the existing SQL query, allowing unauthenticated attackers to append arbitrary SQL statements.
An unauthenticated attacker can supply a malicious cookie value that alters backend queries and extracts sensitive information from the WordPress database. The vulnerability carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and high confidentiality impact without requiring authentication or user interaction.
The referenced WordPress plugin changeset shows that version 2.8.3 addresses the remaining sink, and the Wordfence advisory recommends immediate upgrade for sites running the affected release.
The EPSS score rose from lower values to a peak of 0.3138 with a current value of 0.2643, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-60537
Vulnerability details
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient…
more
escaping on the user supplied values and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated SQL injection in public-facing WordPress plugin enables exploitation of internet-facing application for data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the SQL injection by requiring validation and sanitization of user-supplied cookie values before use in database queries.
Ensures timely identification, reporting, and patching of the specific SQL injection flaw fixed in plugin version 2.8.3.
Enables proactive detection of SQL injection vulnerabilities like this one in WordPress plugins through regular vulnerability scanning and remediation.