CVE-2022-2958: 
WordPress vulnerability analysis and mitigation

CVE-2022-2958 is a SQL Injection vulnerability discovered in the BadgeOS WordPress plugin versions prior to 3.7.1.3. The vulnerability was publicly disclosed on August 23, 2022, and affects the plugin's handling of AJAX actions (WPScan).

The vulnerability stems from improper sanitization and escaping of parameters in SQL statements via AJAX actions. This security flaw is accessible to any authenticated users, including those with subscriber-level access. The vulnerability has been classified as CWE-89 and received a CVSS score of 7.7 (High) (WPScan).

When exploited, this vulnerability allows authenticated users to perform SQL injection attacks against the affected WordPress installation. This could potentially lead to unauthorized access to or manipulation of the database (WPScan).

A proof of concept exists demonstrating the vulnerability can be exploited through a specific URL pattern targeting the admin-ajax.php endpoint with manipulated parameters. The exploit is accessible to any authenticated user, including those with minimal privileges such as subscribers (WPScan).

The vulnerability has been patched in BadgeOS version 3.7.1.3. Users are advised to update to this version or later to mitigate the risk (WPScan).