Name: CVE-2022-3494: Improper Neutralization of Special Elements used in an SQL Command
Creator: Rapid7
Published: 2022-11-07T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2022-3494, CWE-89, CVSS 8.8, EPSS 0.00918

The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML.

CVSS Details

CVSS 3.1 Base Score: 8.8
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Complianz Gdpr Plugin	—	Update complianz-gdpr plugin to version 6.3.4, or a newer patched version	May 15, 2025	Oct 17, 2022
Complianz Gdpr Premium Plugin	—	Update complianz-gdpr-premium plugin to version 6.3.6, or a newer patched version	May 15, 2025	Oct 17, 2022

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business