Cyber Resilience

CVE-2023-7337

High

Published: 04 March 2026

Published
04 March 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.2643 96.4th percentile
Risk Priority 31 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-7337 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Other Platforms; in the Privacy and Disclosure risk domain.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL injection in version 2.8.2 via the 'js-support-ticket-token-tkstatus' cookie. The flaw stems from an incomplete remediation of CVE-2023-50839 that left a second code sink with insufficient escaping of user-supplied values and inadequate parameterization of the existing SQL query, allowing unauthenticated attackers to append arbitrary SQL statements.

An unauthenticated attacker can supply a malicious cookie value that alters backend queries and extracts sensitive information from the WordPress database. The vulnerability carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and high confidentiality impact without requiring authentication or user interaction.

The referenced WordPress plugin changeset shows that version 2.8.3 addresses the remaining sink, and the Wordfence advisory recommends immediate upgrade for sites running the affected release.

The EPSS score rose from lower values to a peak of 0.3138 with a current value of 0.2643, indicating that exploitation interest increased after disclosure.

EU & UK References

Vulnerability details

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient…

more

escaping on the user supplied values and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CWE(s)

AI Security AnalysisAI

AI Category
Other Platforms
Risk Domain
Privacy and Disclosure
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: ai

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct remote unauthenticated SQL injection in public-facing WordPress plugin enables exploitation of internet-facing application for data access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-22850Shared CWE-89
CVE-2026-22730Shared CWE-89
CVE-2026-30860Shared CWE-89
CVE-2026-41640Shared CWE-89
CVE-2026-22687Shared CWE-89
CVE-2026-2993Shared CWE-89
CVE-2026-28438Shared CWE-89
CVE-2026-32628Shared CWE-89
CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89

Affected Assets

Wordpress
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly addresses the SQL injection by requiring validation and sanitization of user-supplied cookie values before use in database queries.

prevent

Ensures timely identification, reporting, and patching of the specific SQL injection flaw fixed in plugin version 2.8.3.

prevent

Enables proactive detection of SQL injection vulnerabilities like this one in WordPress plugins through regular vulnerability scanning and remediation.

References