CVE-2022-3494 - Vulnerability Details - OpenCVE

The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Really-simple-plugins	Complianz

Configuration 1 [-]

OR	cpe:2.3:a:really-simple-plugins:complianz:::::-:wordpress::
	cpe:2.3:a:really-simple-plugins:complianz:::::premium:wordpress::

No data.

References

Link	Providers
https://wpscan.com/vulnerability/71db75c0-5907-4237-884f-8db88b1a9b34

History

Thu, 01 May 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2022-11-07T00:00:00.000Z

Updated: 2025-05-01T19:27:15.809Z

Reserved: 2022-10-13T00:00:00.000Z

Link: CVE-2022-3494

Vulnrichment

Updated: 2024-08-03T01:14:01.457Z

NVD

Status : Modified

Published: 2022-11-07T10:15:12.030

Modified: 2025-05-01T20:15:33.697

Link: CVE-2022-3494

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:really-simple-plugins:complianz:*:*:*:*:-:wordpress:*:*", "matchCriteriaId": "9F4C6567-B79D-4FF7-8EF0-66830DB00F3B", "versionEndExcluding": "6.3.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:really-simple-plugins:complianz:*:*:*:*:premium:wordpress:*:*", "matchCriteriaId": "92353FAF-33AB-4395-AC2D-CD9AEBE1A4DA", "versionEndExcluding": "6.3.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML."}, {"lang": "es", "value": "El complemento Complianz WordPress anterior a 6.3.4 y el complemento Complianz Premium WordPress anterior a 6.3.6 permiten a los traductores inyectar SQL arbitrario a trav\u00e9s de una traducci\u00f3n no sanitizada. SQL puede ser inyectado a trav\u00e9s de un archivo de traducci\u00f3n infectado o por un usuario con funci\u00f3n de traductor a trav\u00e9s de complementos de traducci\u00f3n como Loco Translate o WPML."}], "id": "CVE-2022-3494", "lastModified": "2025-05-01T20:15:33.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-11-07T10:15:12.030", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/71db75c0-5907-4237-884f-8db88b1a9b34"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/71db75c0-5907-4237-884f-8db88b1a9b34"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "contact@wpscan.com", "type": "Secondary"}]}