CVE-2022-4049: Wp User Project Wp User

Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days.

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Affected products

• Wp User Project Wp User: up to and including 7.0

Published 2023-01-02. Last modified 2026-06-17.