CVE-2022-0513

CWE-89 — SQL Injection3 documents3 sources
Severity
7.5HIGH
EPSS
30.4%
top 3.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Veronalabs WP Statistics
Timeline
PublishedFeb 16
Latest updateFeb 17

Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5veronalabs/wp_statistics13.1.4 — 13.1.4

Patches

Patch: plugins.trac.wordpress.org ↗Patch: www.wordfence.com ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-6gr9-x8m9-c46v: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter↗2022-02-17
▶
CVEList
WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason↗2022-02-16
▶