CVE-2022-4681: The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available…

PriorityP268critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

3.82%

88.8th percentile

The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
wpwave	hide_my_wp	< 6.2.9	6.2.9

Detection & IOCsextracted from sources · hover to see the quote

commandcurl -k --location --request GET "http://localhost:10008" --header "X-Forwarded-For: 127.0.0.1'+(select*from(select(sleep(20)))a)+'"↗

otherX-Forwarded-For: 127.0.0.1'+(select*from(select(sleep(20)))a)+'↗

→Detect time-based blind SQLi payloads injected via the X-Forwarded-For HTTP header targeting the Hide My WP plugin AJAX action (unauthenticated). Look for SQL sleep/benchmark patterns in X-Forwarded-For header values. ↗
→The vulnerability is exploitable by unauthenticated users via an AJAX action — monitor WordPress wp-admin/admin-ajax.php requests from unauthenticated sessions that include anomalous X-Forwarded-For header values containing SQL syntax. ↗

·The SQLi payload is delivered through the X-Forwarded-For header, meaning WAF/IDS rules must inspect HTTP headers — not just the request body or URL query parameters — to detect this attack vector. ↗
·The exploit was tested on Hide My WP v6.2.7 and affects all versions prior to 6.2.9; detection should key on plugin version as well as behavioral indicators. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

cisa9.8CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.