CVE-2022-0434
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform SQL injection attacks against WordPress sites using the Page View Count plugin. Attackers can potentially access, modify, or delete database content. All WordPress sites with vulnerable versions of this plugin are affected.
💻 Affected Systems
- WordPress Page View Count plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, site defacement, privilege escalation, or remote code execution via database functions.
Likely Case
Data extraction from WordPress database including user credentials, sensitive content, or plugin data.
If Mitigated
Limited impact if proper WAF rules block SQL injection patterns or database permissions are restricted.
🎯 Exploit Status
SQL injection via post_ids parameter in REST API endpoint requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.15
Vendor Advisory: https://wpscan.com/vulnerability/be895016-7365-4ce4-a54f-f36d0ef2d6f1
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Page View Count' plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.4.15+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable REST endpoint
allRemove or restrict access to the vulnerable REST API endpoint
Add to theme's functions.php or custom plugin: remove_action('rest_api_init', 'pvc_rest_api_init');
Web Application Firewall rule
allBlock SQL injection patterns targeting the vulnerable endpoint
WAF rule to block: POST /wp-json/pvc/v1/postview with SQL injection patterns in post_ids parameter
🧯 If You Can't Patch
- Temporarily disable the Page View Count plugin
- Implement strict network ACLs to limit access to WordPress REST API endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Page View Count version numberCheck Version:
wp plugin list --name='page-view-count' --field=versionVerify Fix Applied:
Confirm plugin version is 2.4.15 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple POST requests to /wp-json/pvc/v1/postview with SQL patterns
Network Indicators:
- POST requests to vulnerable endpoint with SQL injection payloads in post_ids parameter
SIEM Query:
source="web_logs" AND uri_path="/wp-json/pvc/v1/postview" AND (post_ids CONTAINS "UNION" OR post_ids CONTAINS "SELECT" OR post_ids CONTAINS "' OR '")