CVE-2022-0657

5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi

State: Published
Severity: Not scored
Published: Apr 25, 2022
Updated: Aug 2, 2024
Reserved: Feb 17, 2022

Description

The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using sanitize_text_field(), however such function is not intended to prevent SQL injections.

Scores

The record has no CVSS score.

Weaknesses

CWE-89 SQL Injection

Affected Products

Product	Versions
5 Stars Rating Funnel WordPress Plugin \| RRatinggUnknown	1.2.54 to before 1.2.54Affected

References

https://wpscan.com/vulnerability/e7fe8218-4ef5-4ef9-9850-8567c207e8e6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.