CVE-2022-4681: Hide My WP < 6.2.9 - Unauthenticated SQLi

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-02-06 · updated 2026-06-17

Description

The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Affected products

wpWave Hide My WP (WordPress plugin): before 6.2.9 — fixed in 6.2.9

How to fix

Upgrade to a fixed version: wpWave Hide My WP (WordPress plugin) 6.2.9. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/5a4096e8-abe4-41c4-b741-c44e740e8689
https://wpscan.com/vulnerability/5a4096e8-abe4-41c4-b741-c44e740e8689

Get alerted when CVE-2022-4681 or the next vulnerability affects your stack