Wp User Merger Vulnerabilities

The WP User Merger plugin for WordPress is vulnerable to generic SQL Injection via 'user_id' parameter (in function 'wpus_get_order_ids_by_user') in versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVSS:

7.2

Affected:

up to 1.5.2

Fixed in:

1.5.3

Disclosed:

Nov 7, 2022

CVE-2022-3848 on NVD →

The WP User Merger plugin for WordPress is vulnerable to generic SQL Injection via 'reassign_user' parameter versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for administrator-level attac...

CVSS:

7.2

Affected:

up to 1.5.2

Fixed in:

1.5.3

Disclosed:

Nov 7, 2022

CVE-2022-3849 on NVD →

The WP User Merger plugin for WordPress is vulnerable to generic SQL Injection via 'user_id' parameter (in function 'wpum_admin_init') in versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVSS:

7.2

Affected:

up to 1.5.2

Fixed in:

1.5.3

Disclosed:

Nov 7, 2022

CVE-2022-3865 on NVD →