CVE-2022-29411 HIGH

CVE-2022-29411: WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Unauthenticated SQL Injection SQLi) vulnerability

Vendor Mufeng

Product Hermit 音乐播放器 (WordPress plugin)

Weakness CWE-89 · SQLi

Published April 28, 2022

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers to execute SQLi attack via (&id).

Explanation of Vulnerability in Simple Terms

02Summary

The Hermit music player WordPress plugin version 3.1.6 and earlier contains a SQL injection vulnerability in an unauthenticated endpoint. An attacker can craft malicious input to execute arbitrary SQL queries against the site's database, potentially reading or modifying sensitive data. The vulnerability requires no user interaction and can be exploited remotely over the network.

What an attacker can do

03Attacker Capabilities

Execute SQL queries to read or modify database contents without authentication.

Potential impact on your site

04Site Impact

Attackers can steal user data, modify posts/settings, or disrupt site availability without needing a WordPress account.

Conditions required to exploit

05Prerequisites

Network access to the WordPress site; no authentication or user interaction required.

Key dates

06Disclosure timeline

April 28, 2022 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-29411 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

Identifiers

CVE CVE-2022-29411

CWE CWE-89

CVSS 8.3 / HIGH

Affected versions