High severity · published Sep 16, 2022
CVE-2022-2798
The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection…
8.0
CVSS
1.2%
EPSS
No
On KEV
Description
The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Affiliates Manager · Wpaffiliatemanager
before 2.9.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2798
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2798
Exploit
https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd
More from Affiliates Manager
8.8
CVE-2023-52130
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31
8.8
CVE-2023-28986
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions
8.8
CVE-2019-15868
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF
7.2
CVE-2021-24844
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL…
6.1
CVE-2021-25078
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing…