cbcvebase.
CVE-2022-0826
published 2022-05-09

CVE-2022-0826: The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to…

PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
9.05%
94.6th percentile
The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users

Affected

1 ranges
VendorProductVersion rangeFixed in
wp-video-gallery-free_projectwp-video-gallery-free<= 1.7.1—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-admin/admin-ajax.php↗
commandaction=wp_video_gallery_ajax_add_single_youtube&url=http://oast.me/?x%26v=1%2522 AND (SELECT 1780 FROM (SELECT(SLEEP(6)))uPaz)%2523↗
  • →Detect unauthenticated POST requests to /wp-admin/admin-ajax.php with action=wp_video_gallery_ajax_add_single_youtube containing SQL time-based blind injection payloads (e.g., SLEEP) in the 'url' parameter. ↗
  • →Successful exploitation returns HTTP 200 with body containing 'Registred videos :' and Content-Type text/html; monitor for anomalous response durations >=6 seconds on this endpoint. ↗
  • →The vulnerability is exploitable by unauthenticated users via an AJAX action; no authentication cookies or nonces are required in the POST request. ↗
  • ·The time-based detection threshold is set to 6 seconds (SLEEP(6)); tuning may be needed in high-latency environments to avoid false positives or false negatives. ↗
  • ·Affected versions are WP Video Gallery plugin through 1.7.1; versions 1.7.2 and above are patched. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.