CVE-2022-3848

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	WP User Merger	< 1.5.3

References

https://bulletin.iese.de/post/wp-user-merger_1-5-1_2/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/da1f0313-2576-490e-a95f-bf12de340610Exploit, Third Party Advisory
https://bulletin.iese.de/post/wp-user-merger_1-5-1_2/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/da1f0313-2576-490e-a95f-bf12de340610Exploit, Third Party Advisory

Timeline

Published: Nov 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-384816.1An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several CVE-2022-384824.3A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.CVE-2022-384848.8An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Po CVE-2022-384856.5A directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. A remote authent CVE-2022-384889.8logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.CVE-2022-384895.4An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). Version 2022.1.110.1 CVE-2022-38498.8The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leadi CVE-2022-384908.8An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Some parameters allow SQL injection. Version 2022.1.110.1.02 corrects CVE-2022-384917.5An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-f CVE-2022-384928.8An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. One parameter allows SQL injection. Version 2022.1.110.1.02 fixes the CVE-2022-384937.5Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cau CVE-2022-384957.8LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c.