CVE-2022-47605 HIGH

CVE-2022-47605: WordPress Custom 404 Pro Plugin <= 3.7.0 is vulnerable to SQL Injection (SQLi)

Vendor Kunal Nagar

Product Custom 404 Pro

Weakness CWE-89 · SQLi

Published April 12, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.3/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Custom 404 Pro through version 3.7.0 contains a SQL injection vulnerability in its database query handling. An authenticated administrator with high privileges can inject malicious SQL code by crafting a specially formatted request, but user interaction is required to trigger the vulnerability. This allows reading or modifying database contents, though availability impact is limited.

What an attacker can do

03Attacker Capabilities

Read or modify database contents via SQL injection.

Potential impact on your site

04Site Impact

An admin account could be compromised to extract sensitive data or alter site configuration and content.

Conditions required to exploit

05Prerequisites

Administrator account required; attacker must trick an admin into clicking a malicious link or visiting a crafted page.

Key dates

06Disclosure timeline

April 12, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-47605 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities