CVE-2022-2559 Fluent Support < 1.5.8 - Admin+ SQLi
High-privilege users can exploit SQL injection in the Fluent Support WordPress plugin to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-2559?
CVE-2022-2559 is a high-severity SQL injection vulnerability in Unknown Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin, published on 29 Aug 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users
Weakness: CWE-89
Which versions are affected by CVE-2022-2559?
It affects 1 product.
Products include Wpmanageninja Fluent Support.
How do I fix CVE-2022-2559?
No fix has been published for CVE-2022-2559 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-2559 being exploited?
There is no known exploitation of CVE-2022-2559 in the wild and no public exploit code.
Other vulnerabilities in Unknown Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin
- CVE-2024-47304 WordPress Fluent Support plugin <= 1.8.0 - SQL Injection vulnerability
- CVE-2023-51547 WordPress Fluent Support Plugin <= 1.7.6 is vulnerable to SQL Injection
- CVE-2024-13568 Information disclosure in Fluent Support – Helpdesk & Customer Support Ticket System
- CVE-2024-47302 WordPress Fluent Support plugin <= 1.8.0 - Broken Access Control on Email Verification vulnerability
Sources
Also known as GHSA-fwhw-c399-g8qm.