CVE-2022-3848

CWE-89 — SQL InjectionCWE-7726 documents6 sources
Severity
8.8HIGH
EPSS
0.5%
top 33.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown WP User MergerWP User Merger Project WP User Merger
Timeline
PublishedNov 28
Latest updateDec 24

Description

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5unknown/wp_user_merger< 1.5.3

🔴Vulnerability Details

3
OSV
vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init()↗2025-12-24
▶
GHSA
GHSA-fp36-pmr8-vj9p: The WP User Merger WordPress plugin before 1↗2022-11-28
▶
CVEList
WP User Merger < 1.5.3 - Admin+ SQLi via wpsu_user_id↗2022-11-28
▶
CVE-2022-3848 (HIGH CVSS 8.8) | The WP User Merger WordPress plugin | cvebase.io