CVE-2022-3494: 
WordPress vulnerability analysis and mitigation

CVE-2022-3494 affects the Complianz WordPress plugin before version 6.3.4 and Complianz Premium WordPress plugin before version 6.3.6. The vulnerability was discovered and publicly disclosed on October 17, 2022. This security issue allows translators to inject arbitrary SQL through unsanitized translations, either through infected translation files or by users with translator roles using translation plugins like Loco Translate or WPML (WPScan).

The vulnerability is classified as an SQL Injection (SQLI) with a CVSS score of 5.8 (medium severity) and is mapped to CWE-89. The issue occurs when translating specific text strings related to cookie consent messaging. The vulnerability can be exploited through the WordPress admin panel by users with translator privileges, particularly when certain advertising-related settings are enabled in the Complianz wizard (WPScan).

When successfully exploited, this vulnerability allows attackers with translator privileges to execute arbitrary SQL queries against the WordPress database. This could potentially lead to unauthorized access to sensitive data, including user information stored in the database (WPScan).

The vulnerability has been patched in Complianz version 6.3.4 and Complianz Premium version 6.3.6. Users are advised to update to these versions or later to mitigate the risk. The fix addresses the unsanitized translation input that allowed for SQL injection (WPScan).