CVE-2022-0827

Bestbooks <= 2.6.3 - Unauthenticated SQLi

Basic Information

CVE State: PUBLISHED
Reserved Date: March 02, 2022
Published Date: June 13, 2022
Last Updated: August 02, 2024
Vendor: Unknown
Product: Bestbooks
Description: The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Tags

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Score

Score: 75.78% (Percentile: 98.83%) as of 2025-06-07

Exploit Status

Exploited in the Wild: Yes (2025-05-10 00:00:00 UTC) Source

References

https://wpscan.com/vulnerability/0d208ebc-7805-457b-aa5f-ffd5adb2f3be

Known Exploited Vulnerability Information

Source	Added Date
The Shadowserver (via CIRCL)	2025-05-10 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0827.yaml	2025-04-26 00:00:00 UTC

Timeline

CVE ID Reserved

March 02, 2022
CVE Published to Public

June 13, 2022
Detected by Nuclei

April 26, 2025
Added to KEVIntel

May 10, 2025