CVE-2022-0657

CVE-2022-0657: 5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi

Vendor Unknown

Product 5 Stars Rating Funnel WordPress Plugin | RRatingg

Weakness CWE-89 · SQLi

Published April 25, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using sanitize_text_field(), however such function is not intended to prevent SQL injections.

Key dates

02Disclosure timeline

April 25, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0657 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2024-11818 PHPGurukul User Registration & Login and User Management System signup.php sql injection CVE-2021-31849 Data Loss Prevention (DLP) ePO extension - SQL injection CVE-2025-13126 wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection CVE-2025-62179 WeGIA SQL Injection via 'cpf' param at endpoint `/html/funcionario/cadastro_funcionario_pessoa_existente.php` CVE-2025-32120 WordPress Easy Query – WP Query Builder plugin <= 2.0.4 - SQL Injection Vulnerability