CVE-2022-0846 is a critical SQL Injection vulnerability affecting the SpeakOut! Email Petitions WordPress plugin versions prior to 2.14.15.1. The flaw allows unauthenticated attackers to inject malicious SQL queries due to improper sanitization of the 'id' parameter in the dk_speakout_sendmail AJAX action. This vulnerability carries a CVSS score of 9.8 (Critical), indicating it is easily exploitable over the network with no user interaction, leading to complete compromise of confidentiality, integrity, and availability. Its high EPSS score and FAUCET Risk Score of 99/100 highlight a significant likelihood of exploitation. While there is no evidence of active exploitation (KEV list) or Metasploit modules, Nuclei templates exist for detecting this vulnerability. The CVE has garnered significant community discussion, with recent posts on GitHub indicating awareness and potential for exploit development.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.14.15.1CPE matchmatch criteria | cpe:2.3:a:speakout\!_email_petitions_project:speakout\!_email_petitions:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.