CVE-2022-4059: The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action…

PriorityP180critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

ITWEXPLOITVulnCheck KEV

Exploited in the wild

EPSS

4.76%

90.8th percentile

The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
blocksera	cryptocurrency_widgets_pack	<= 1.8.1	—

Detection & IOCsextracted from sources · hover to see the quote

→SQL injection via AJAX action available to unauthenticated users in Cryptocurrency Widgets Pack WordPress plugin before version 2.0; the vulnerable parameter is not sanitised or escaped before use in a SQL statement ↗
→Detection fingerprint: HTTP 302 redirect on first request, and response body of second request contains the string 'Cryptocurrency Widgets Pack' — indicative of plugin presence probe used in exploitation attempts

·The nuclei-style template digest provided may be used to identify the specific detection template for this CVE, but the source URL for the template was not provided in the source material
·The SQL injection payload used in the detection template is a numeric time/boolean-based probe (value '=7'') sent to an unauthenticated AJAX endpoint; the specific AJAX action name is not disclosed in the available sources

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck9.8CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.