CVE-2022-3769: 
WordPress vulnerability analysis and mitigation

The OWM Weather WordPress plugin versions prior to 5.6.9 contains a SQL injection vulnerability (CVE-2022-3769) that was discovered and disclosed on November 2, 2022. The vulnerability affects users with contributor-level permissions or higher, allowing them to execute SQL injection attacks through unsanitized parameters (WPScan).

The vulnerability stems from improper sanitization and escaping of parameters before their use in SQL statements. The issue has been assigned a CVSS score of 7.7 (High) and is classified as a SQL Injection vulnerability (CWE-89). It falls under the OWASP Top 10 category A1: Injection (WPScan).

An authenticated user with contributor-level access or higher can execute arbitrary SQL commands against the database through the vulnerable parameter. This could potentially lead to unauthorized access to sensitive data, manipulation of database contents, or other malicious database operations (WPScan).

The vulnerability has been patched in version 5.6.9 of the OWM Weather plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).