CVE-2022-0867: reputeinfosystems pricing_table SQL Injection
CVSS: 9.8v3.1CriticalModified
Published 16-05-2022Last modified 02-08-2024
Vulnerability summary
CVE-2022-0867 is a critical (CVSS 9.8) SQL Injection vulnerability in reputeinfosystems pricing_table. EPSS estimates a 13.45% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
13.45%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 16-05-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users
CVSS metrics
3 scores · 2 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
13.45%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 13.45% on 22-09-2026
22-09-202622-10-2026
EPSS score13.45%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Reputeinfosystems1 product
- pricing_table< 3.6.1
Unknown1 product
- pricing table plugin≥ 3.6.1, < 3.6.1
Wordpress1 product
- arprice-responsive-pricing-table≤ 3.6 (fixed in 3.6.1)
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/62803aae-9896-410b-9398-3497a838e494X Refsource MISCExploitThird Party Advisory