Security readout for executives and security teams
Plain-English summary
This is a high-severity WordPress plugin SQL injection. An authenticated user with permission to add or edit terms or tags could potentially access or alter database information. The cited record says version 3.6 was only partially patched and version 3.7 fully fixed the issue.
Executive priority
Prioritize remediation on public WordPress sites and any site with multiple content contributors. This is not confirmed as actively exploited in the supplied evidence, but it can turn a lower-privileged authenticated account into a database-impacting incident.
Technical view
CVE-2022-4290 is CWE-89 in the Cyr to Lat WordPress plugin through 3.5. The ctl_sanitize_title function insufficiently escaped user input and did not adequately prepare an SQL query, allowing authenticated term/tag editors to append SQL into existing queries.
Likely exposure
Likely exposure is WordPress sites running Cyr to Lat through 3.5 where authenticated users can add or modify terms or tags. The bundle contains inconsistent affected-product metadata, so confirm the installed plugin slug and version locally.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no cited source claims active exploitation. The issue still matters because PR:L, AC:L, and high confidentiality, integrity, and availability impacts can make compromised editor-like accounts more damaging.
Researcher notes
Focus validation on plugin version, vulnerable function exposure through term/tag workflows, and user roles with taxonomy modification capability. Avoid assuming exploitability without an authenticated path. Treat the affected-product naming inconsistency as a data-quality issue to resolve during asset validation.
Mitigation direction
- Update Cyr to Lat to version 3.7 or later.
- Do not rely on version 3.6 as fully remediated.
- Restrict term and tag editing permissions to trusted users.
- Review vendor and Wordfence guidance before exceptions.
- Remove the plugin if it is unused.
Validation and detection
- Inventory WordPress sites for the Cyr to Lat plugin.
- Verify installed plugin versions are 3.7 or later.
- Confirm term and tag modification permissions are limited.
- Review logs for unusual term or tag changes.
- Check database error logs for suspicious query failures.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-4290 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.