CVE-2022-40839
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A SQL injection vulnerability in the height and width parameters in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate database data.
Risk Assessment
Attackers can steal sensitive database data, leading to confidentiality and integrity breaches.
Recommendation
Immediately update NdkAdvancedCustomizationFields to the latest version and use parameterized SQL queries for the height and width parameters.
Other vulnerabilities in NdkAdvancedCustomizationFields
See all- CVE-2022-40842Critical
The NdkAdvancedCustomizationFields plugin version 3.5.0 for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via the rotateimg.php file. An attacker can exploit this to send requests from the server to internal network resources.
- CVE-2022-40841Medium
A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the 'htmlNodes' parameter.
- CVE-2022-40840Medium
The NdkAdvancedCustomizationFields 3.5.0 plugin for ndk design is vulnerable to Cross-Site Scripting (XSS) in the createPdf.php file. This allows an attacker to inject malicious JavaScript code into the page.
Original NVD description (English source)
A SQL injection vulnerability in the height and width parameter in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate database data.