← CVE Intelligence

CVE-2022-0657

5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi PUBLISHED

Description (CNA)

The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using sanitize_text_field(), however such function is not intended to prevent SQL injections.

Affected (CNA)

Vendor / productVersions
Unknown / 5 Stars Rating Funnel WordPress Plugin | RRatinggaffected 1.2.54 before 1.2.54

CWE

CWE-89

References

ADP enrichment

CVE

No English description supplied.