High severity · published Nov 21, 2022
CVE-2022-3720
Event Monster < 1.2.1 - Admin+ SQLi
7.2
CVSS
1.1%
EPSS
No
On KEV
Description
The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Event Monster ·
before 1.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3720
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3720
Exploit
https://wpscan.com/vulnerability/0139a23c-4896-4aef-ab56-dcf7f07f01e5
More from Event Monster
4.3
CVE-2022-3336
Event Monster < 1.2.0 - Visitors Deletion via CSRF