High severity · published Aug 29, 2022
CVE-2022-2559
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL…
7.2
CVSS
1.2%
EPSS
No
On KEV
Description
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FS
Fluent Support · Wpmanageninja
before 1.5.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2559
Exploit
https://wpscan.com/vulnerability/062599ce-c630-487e-bb43-c3b27a62b9ec
More from Fluent Support
9.8
CVE-2024-47302
WordPress Fluent Support plugin <= 1.8.0 - Broken Access Control on Email Verification vulnerability
8.5
CVE-2024-47304
WordPress Fluent Support plugin <= 1.8.0 - SQL Injection vulnerability
7.5
CVE-2024-13568
Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
7.2
CVE-2023-51547
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC Fluent Support – WordPress Helpdesk and Customer Support…
6.5
CVE-2026-65470
WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability