CVE-2022-4049

CRITICAL 9.8CVE-2022-4049 · Published 02/01/2023 · updated 17/06/2026

In short

CVE-2022-4049 is a CRITICAL (CVSS 9.8) vulnerability affecting wp user (wp user project).
Chance of exploitation in the next 30 days (EPSS): 5.1%, higher than 92.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
wp user wp_user_project	`≤ 7.0`	No fix yet

Description

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

References

wpscan.com/vulnerability/9b0781e2-ad62-4308-bafc-d45b9a2472be · Exploit

More vulnerabilities in wp user

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free