CVE-2022-29410

CVE-2022-29410 is an authenticated SQL Injection vulnerability affecting Mufeng's Hermit 音乐播放器 plugin up to version 3.1.6 on WordPress, allowing attackers with Subscriber-level privileges or higher to execute SQLi attacks via the '&ids' parameter. This high-severity vulnerability (CVSS 8.8) is easily exploitable over the network with low attack complexity, potentially leading to full compromise of confidentiality, integrity, and availability. While no active exploitation, public exploits, or significant community discussion have been observed, its high FAUCET risk score indicates a notable potential threat.