cbcvebase.
CVE-2022-0434
published 2022-03-07

CVE-2022-0434: The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint…

PriorityP183critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
14.78%
96.3th percentile
The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks

Affected

1 ranges
VendorProductVersion rangeFixed in
a3revpage_view_count< 2.4.152.4.15

Detection & IOCsextracted from sources · hover to see the quote

url/?rest_route=/pvc/v1/increase/1&post_ids=0)%20union%20select%20md5({{num}}),null,null%20--%20g↗
path/pvc/v1/increase/1↗
  • →Exploit targets the REST endpoint via the `rest_route` query parameter pointing to `/pvc/v1/increase/1` with a SQL UNION injection payload in the `post_ids` parameter (e.g., `0) union select md5(...),null,null -- g`). No authentication is required. ↗
  • →A successful exploitation response returns HTTP 200 with the MD5 hash of the injected value in the response body — use this as a blind/confirmation check in detection rules. ↗
  • →The vulnerable parameter is `post_ids` in the REST endpoint. Monitor HTTP access logs for requests to `rest_route=/pvc/v1/increase/` containing SQL keywords (UNION, SELECT, --, etc.) in the `post_ids` value. ↗
  • ·The vulnerability is exploitable by unauthenticated users — no credentials or session token are needed, making it trivially weaponizable at scale. ↗
  • ·Affected versions are Page View Count plugin strictly below 2.4.15; version 2.4.15 and above are patched. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.