CVE-2022-0782

Donations <= 1.8 - Unauthenticated SQLi

State: Published
Severity: Not scored
Published: Apr 25, 2022
Updated: Aug 2, 2024
Reserved: Feb 28, 2022

Description

The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

Scores

The record has no CVSS score.

Weaknesses

CWE-89 SQL Injection

Affected Products

Product	Versions
DonationsUnknown	1.8 through 1.8Affected

References

https://wpscan.com/vulnerability/b81e824c-d2b1-4381-abee-18c42bb5c2f5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.