{"id":"GHSA-pq2f-3fg3-rw99","aliases":["CVE-2022-0254"],"title":"SQL Injection in WordPress Zero Spam WordPress plugin","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"The WordPress Zero Spam WordPress plugin before 5.2.13 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection","severity":"critical","score":9.8,"published":"2022-03-15T00:00:57.000Z","modified":"2026-09-10T03:49:18.057Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"bmarshall511/wordpress_zero_spam","sources":[{"name":"OSV · GHSA-pq2f-3fg3-rw99","url":"https://osv.dev/vulnerability/GHSA-pq2f-3fg3-rw99"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.2.13"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["5.2.13"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-0254","https://github.com/Highfivery/zero-spam-for-wordpress/commit/49723f696f1e2f2a76ac89375910bb036a4895f3","https://github.com/Highfivery/zero-spam-for-wordpress","https://plugins.trac.wordpress.org/changeset/2660225","https://plugins.trac.wordpress.org/changeset/2680906","https://wpscan.com/vulnerability/ae54681f-7b89-408c-b0ee-ba4a520db997"],"sources":[{"name":"OSV","id":"GHSA-pq2f-3fg3-rw99","modified":"2026-09-10T03:49:18.057054089Z","url":"https://osv.dev/vulnerability/GHSA-pq2f-3fg3-rw99"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T15:55:32.263Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}