CVE-2022-0747
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands on WordPress sites using the Infographic Maker plugin before version 4.3.8. Attackers can steal sensitive data, modify database contents, or potentially gain administrative access. Any WordPress site with the vulnerable plugin version is affected.
💻 Affected Systems
- Infographic Maker WordPress Plugin
📦 What is this software?
Infographic Maker by Quantumcloud
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, site defacement, backdoor installation, and full administrative control of the WordPress installation.
Likely Case
Data exfiltration including user credentials, sensitive content, and potential privilege escalation to administrator accounts.
If Mitigated
Limited impact with proper input validation, parameterized queries, and web application firewall rules blocking SQL injection patterns.
🎯 Exploit Status
SQL injection via qcld_upvote_action AJAX endpoint with post_id parameter. Exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.8
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2684336
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Infographic Maker plugin. 4. Click 'Update Now' if update available. 5. If no update appears, manually download version 4.3.8+ from WordPress repository.
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoint
linuxBlock access to the qcld_upvote_action endpoint via .htaccess or web server configuration
# Add to .htaccess:
RewriteEngine On
RewriteCond %{QUERY_STRING} action=qcld_upvote_action [NC]
RewriteRule ^wp-admin/admin-ajax\.php$ - [F,L]
Web Application Firewall rule
allImplement WAF rules to block SQL injection patterns targeting the post_id parameter
🧯 If You Can't Patch
- Disable or remove the Infographic Maker plugin entirely
- Implement strict network segmentation and limit external access to affected systems
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for Infographic Maker version. If version is below 4.3.8, system is vulnerable.Check Version:
wp plugin list --name='infographic-maker' --field=versionVerify Fix Applied:
Confirm plugin version is 4.3.8 or higher in WordPress admin panel. Test AJAX endpoint with SQL injection payloads to verify blocking.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in WordPress logs
- Multiple POST requests to /wp-admin/admin-ajax.php with action=qcld_upvote_action
- Suspicious post_id parameter values containing SQL keywords
Network Indicators:
- HTTP POST requests to admin-ajax.php with SQL injection payloads in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="wordpress.log" AND ("qcld_upvote_action" OR "post_id" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE"))