CVE-2022-3769: 
WordPress vulnerability analysis and mitigation

The OWM Weather WordPress plugin versions prior to 5.6.9 contains a SQL injection vulnerability (CVE-2022-3769) that was discovered and disclosed on November 2, 2022. The vulnerability affects users with contributor-level permissions or higher, allowing them to execute SQL injection attacks through unsanitized parameters (WPScan).

The vulnerability stems from improper sanitization and escaping of parameters before their use in SQL statements. The issue has been assigned a CVSS score of 7.7 (High) and is classified as a SQL Injection vulnerability (CWE-89). It falls under the OWASP Top 10 category A1: Injection (WPScan).

An authenticated user with contributor-level access or higher can execute arbitrary SQL commands against the database through the vulnerable parameter. This could potentially lead to unauthorized access to sensitive data, manipulation of database contents, or other malicious database operations (WPScan).

The vulnerability can be exploited by accessing a specific URL pattern: admin.php?action=owmw_duplicate_post_as_draft&post=1 with malicious SQL injection payload. A proof of concept demonstrates that an attacker can cause delayed responses through SQL SLEEP commands, confirming the presence of the vulnerability (WPScan).

The vulnerability has been patched in version 5.6.9 of the OWM Weather plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).