Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2022-0651

CWE-89 — SQL Injection4 documents4 sources
Severity
7.5HIGH
EPSS
69.4%
top 1.35%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
WP Statistics WP StatisticsVeronalabs WP Statistics
Timeline
PublishedFeb 24
Latest updateFeb 25

Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5wp_statistics/wp_statistics13.1.5 — 13.1.5

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-hx7h-9675-wcgc: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter↗2022-02-25
▶
CVEList
WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type↗2022-02-24
▶

💥Exploits & PoCs

1
Nuclei
WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
▶