Critical severity9.8NVD Advisory· Published Sep 19, 2022· Updated Jun 17, 2026

CVE-2022-2840

Description

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Zephyr Project Managerllm-fuzzy2 versions
<3.2.5+ 1 more
- (no CPE)range: <3.2.5
- (no CPE)
Package: https://wordpress.org/plugins/zephyr-project-manager
Zephyr One/Zephyr Project Manager
cpe:2.3:a:zephyr-one:zephyr_project_manager:*:*:*:*:*:wordpress:*:*
Range: <3.2.5

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.htmlnvdExploitThird Party AdvisoryVDB Entry
wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53cnvdExploitPatchThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.008
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000