Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2022-4268: The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
CVE-2022-4268 · published 3 years ago
Summary
The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| plugin_logic_project | plugin_logic |
<= 1.0.7 cpe:2.3:a:plugin_logic_project:plugin_logic:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
References
- https://bulletin.iese.de/post/plugin-logic_1-0-7/ Exploit Third Party Advisory
- https://wpscan.com/vulnerability/bde93d90-1178-4d55-aea9-e02c4f8bcaa2 Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Timeline
Published26 Dec 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-4268 · NVD
Track software like this
Free during beta