CVE-2022-0949: The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the…

PriorityP272critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

7.87%

94.0th percentile

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection

Affected

1 ranges

Vendor	Product	Version range	Fixed in
stopbadbots	block_and_stop_bad_bots	< 6.930	6.930

Detection & IOCsextracted from sources · hover to see the quote

otheraction=stopbadbots_grava_fingerprint↗

otherfingerprint↗

versionBlock Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection < 6.930↗

→The SQLi is triggered via an unauthenticated POST request to wp-admin/admin-ajax.php with the action parameter set to 'stopbadbots_grava_fingerprint' and a malicious 'fingerprint' parameter value. Monitor for SQL metacharacters in the fingerprint field from unauthenticated sessions. ↗
→The nuclei/template detection checks for HTTP 200 response and presence of 'commentform' in the response body as a positive indicator of a vulnerable target.
→Affected plugin versions are strictly below 6.930. Any WordPress installation running 'Block Bad Bots and Stop Bad Bots' plugin version <= 6.929 should be treated as vulnerable. ↗

·The exploit is available to unauthenticated users, meaning no WordPress account or session cookie is required to trigger the SQL injection — WAF rules should apply to all traffic, not just authenticated sessions. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.