cbcvebase.
CVE-2022-0769
published 2022-04-25

CVE-2022-0769: The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL…

PriorityP182critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
8.42%
94.3th percentile
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.

Affected

1 ranges
VendorProductVersion rangeFixed in
usersultrausers_ultra<= 3.1.0—

Detection & IOCsextracted from sources · hover to see the quote

otherrating_vote AJAX action↗
  • →Exploit targets the `rating_vote` AJAX action via unsanitized `data_target` parameter, injectable by both unauthenticated and authenticated users — monitor WordPress AJAX requests (wp-admin/admin-ajax.php) for `action=rating_vote` with anomalous `data_target` values (e.g., SQL metacharacters). ↗
  • →HTTP 200 response containing the string 'You have to be logged in to leave your rate' in the body can be used as a fingerprint to confirm a vulnerable Users Ultra plugin instance is present.
  • →Nuclei/probe template targets Users Ultra plugin versions up to and including 3.1.0; match on status_code 200 and content-type text/html alongside the body string for positive identification.
  • ·The vulnerability affects Users Ultra WordPress plugin through version 3.1.0; versions above this threshold may be patched. ↗
  • ·The SQLi is exploitable by unauthenticated users, meaning no authentication bypass is required — any public-facing WordPress site with this plugin is at risk. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.