CVE-2022-0817 is a critical SQL Injection vulnerability affecting the BadgeOS WordPress plugin up to version 3.7.0. It allows unauthenticated attackers to inject malicious SQL statements due to improper sanitization of a parameter in an AJAX action. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network with no user interaction, potentially leading to full compromise of confidentiality, integrity, and availability. While not currently on CISA's KEV catalog, a Nuclei template exists for detection, and its high EPSS and FAUCET scores indicate significant risk, despite a lack of public exploit code or community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.7.0CPE matchmatch criteria | cpe:2.3:a:badgeos:badgeos:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.