CVE-2022-3849: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2022-3849 affects the WordPress plugin WP User Merger versions below 1.5.3. This security flaw was publicly disclosed on November 7, 2022, and involves a SQL injection vulnerability that can be exploited by users with administrative privileges (WPScan).

The vulnerability stems from improper sanitization and escaping of a parameter before its use in SQL statements. The issue has been assigned a CVSS score of 6.8 (medium severity) and is classified as a SQL Injection vulnerability under OWASP Top 10 category A1: Injection and CWE-89 (WPScan).

When exploited, this vulnerability allows attackers with administrative access to perform SQL injection attacks against the WordPress database, potentially leading to unauthorized data access or manipulation (WPScan).

The vulnerability can be exploited through the user-edit.php endpoint by manipulating the user_id parameter. A proof of concept exists showing that an attacker can inject SQL commands, including the ability to cause delays in server response through SQL SLEEP functions (WPScan).

The vulnerability has been patched in WP User Merger version 1.5.3. Users are advised to update to this version or later to protect against this security issue (WPScan).