SQL Injection in WordPress Zero Spam WordPress plugin

CRÍTICO 9.8CVE-2022-0254 · GHSA-pq2f-3fg3-rw99 · Published 14/03/2022 · updated 17/06/2026

En resumen

CVE-2022-0254 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a bmarshall511/wordpress_zero_spam, zero-spam (highfivery).
Probabilidad de explotación en los próximos 30 días (EPSS): 2.0%, mayor que el 81.1% de las vulnerabilidades.
Solución: actualizar a 5.2.13, 5.2.11 o posterior.

Package	Affected versions	Patched versions
bmarshall511/wordpress_zero_spam Packagist	`< 5.2.13`	`5.2.13`
zero-spam highfivery	`< 5.2.11`	`5.2.11`

Description

The WordPress Zero Spam WordPress plugin before 5.2.13 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection

NVD description

The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection

References

nvd.nist.gov/vuln/detail/CVE-2022-0254 · ADVISORY
Highfivery/zero-spam-for-wordpress commit 49723f6 · WEB
Highfivery/zero-spam-for-wordpress · PACKAGE
plugins.trac.wordpress.org/changeset/2660225 · WEB
plugins.trac.wordpress.org/changeset/2680906 · WEB
wpscan.com/vulnerability/ae54681f-7b89-408c-b0ee-ba4a520db997 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free