CVE-2022-0693: 
WordPress vulnerability analysis and mitigation

The Master Elements WordPress plugin through version 8.0 contains an unauthenticated SQL Injection vulnerability (CVE-2022-0693). The vulnerability was discovered and publicly disclosed on March 29, 2022, affecting the plugin's remove_post_meta_condition AJAX action functionality (WPScan).

The vulnerability stems from improper validation and escaping of the meta_ids parameter in the remove_post_meta_condition AJAX action. This action is accessible to both authenticated and unauthenticated users. The vulnerability has been classified as SQL Injection (CWE-89) with a critical CVSS score of 9.3 (WPScan).

The vulnerability allows unauthenticated attackers to perform SQL injection attacks against affected WordPress installations, potentially leading to unauthorized database access and manipulation (WPScan).

A proof of concept exploit exists and has been publicly disclosed. The exploit involves sending a crafted request to the WordPress admin-ajax.php endpoint with a malicious meta_ids parameter that can trigger a time-based SQL injection (WPScan).

As of the latest reports, there is no known fix available for this vulnerability. Users of the Master Elements plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).