CVE-2022-4447: The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to…

PriorityP181critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

ITWEXPLOITVulnCheck KEV

Exploited in the wild

EPSS

4.79%

90.8th percentile

The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
fontsy_project	fontsy	<= 1.8.6	—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-admin/admin-ajax.php?action=get_tag_fonts↗

commandid=-5219 UNION ALL SELECT NULL,NULL,NULL,md5(999999999),NULL--↗

→Detect unauthenticated POST requests to /wp-admin/admin-ajax.php with action=get_tag_fonts, which is the vulnerable AJAX endpoint exploited for SQL injection. ↗
→Look for UNION-based SQL injection payloads in the POST body 'id' parameter, particularly patterns like negative integer followed by UNION ALL SELECT with NULL columns and md5() calls. ↗
→The vulnerability is exploitable by unauthenticated users (no authentication required), so filter on requests lacking valid WordPress authentication cookies to the admin-ajax endpoint. ↗
→Content-Type of the exploit request is application/x-www-form-urlencoded; monitor for this combined with the get_tag_fonts action parameter. ↗

·The vulnerable plugin version is 1.8.6 and below; version 1.8.7 or the vendor patch resolves the issue. Ensure detections are scoped to sites running Fontsy <= 1.8.6. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck9.8CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.