CVE-2022-0693: The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available…

PriorityP270critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

7.18%

93.5th percentile

The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection

Affected

1 ranges

Vendor	Product	Version range	Fixed in
devbunch	master_elements	<= 8.0	—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-admin/admin-ajax.php?meta_ids=1+AND+(SELECT+3066+FROM+(SELECT(SLEEP(6)))CEHy)&action=remove_post_meta_condition↗

path/wp-admin/admin-ajax.php↗

commandaction=remove_post_meta_condition&meta_ids=1+AND+(SELECT+3066+FROM+(SELECT(SLEEP(6)))CEHy)↗

→Detect unauthenticated time-based SQL injection attempts against the remove_post_meta_condition AJAX action by monitoring for SLEEP() payloads in the meta_ids parameter of requests to /wp-admin/admin-ajax.php ↗
→A successful exploitation response contains the string 'Post Meta Setting Deleted Successfully' with HTTP 200 and a response duration >= 6 seconds (due to SLEEP(6) payload) ↗
→Flag requests to admin-ajax.php where action=remove_post_meta_condition and meta_ids contains SQL keywords such as SELECT, SLEEP, or AND — this endpoint is exploitable by unauthenticated users ↗
→Use time-based detection: if a request to the remove_post_meta_condition action causes a response delay of 6 or more seconds, it is indicative of a successful blind SQL injection via SLEEP() ↗

·The vulnerability affects Master Elements WordPress plugin through version 8.0; version 8.1 and above contain the fix. Ensure detections are scoped to environments running versions <= 8.0. ↗
·The AJAX action remove_post_meta_condition is accessible without authentication (unauthenticated), meaning no session or nonce token is required for exploitation — WAF/IDS rules should not require auth context to trigger. ↗
·The nuclei template uses a 10-second request timeout (@timeout: 10s) to accommodate the SLEEP(6) payload; detection infrastructure must allow sufficient timeout windows to observe time-based delays. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.