What’s Vulnerable › Vulnerabilities

CVE-2022-3768: WPSmartContracts < 1.3.12 - Author+ SQLi

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-11-28 · updated 2026-06-17
• Weakness: CWE-89

Description

The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author

Affected products

• WPSmartContracts: before 1.3.12 — fixed in 1.3.12

How to fix

Upgrade to a fixed version: WPSmartContracts 1.3.12. Check the vendor advisory for mitigations.

References

• https://bulletin.iese.de/post/wp-smart-contracts_1-3-11/
• https://wpscan.com/vulnerability/1d8bf5bb-5a17-49b7-a5ba-5f2866e1f8a3
• https://bulletin.iese.de/post/wp-smart-contracts_1-3-11/
• https://wpscan.com/vulnerability/1d8bf5bb-5a17-49b7-a5ba-5f2866e1f8a3

Get alerted when CVE-2022-3768 or the next vulnerability affects your stack