CVE-2022-0651: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in…

PriorityP268high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EXPLOIT

EPSS

32.98%

98.1th percentile

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
veronalabs	wp_statistics	<= 13.1.5	—
wp_statistics	wp_statistics	13.1.5 – 13.1.5	—

Detection & IOCsextracted from sources · hover to see the quote

path~/includes/class-wp-statistics-hits.php↗

othercurrent_page_type (SQL injection parameter)↗

sigma

status_code == 200 AND contains(header, 'application/json') AND contains(body, 'Visitor Hit was recorded successfully')

→Unauthenticated SQL injection via the `current_page_type` POST/GET parameter to the WP Statistics hits endpoint; monitor for anomalous SQL syntax in this parameter. ↗
→Successful exploitation returns HTTP 200 with Content-Type application/json and body containing 'Visitor Hit was recorded successfully'; use this as a confirmation indicator in WAF/IDS rules.
→Nuclei template extracts a `_wpnonce` value from the response using regex `_wpnonce=([0-9a-zA-Z]+)` as an internal chained step; monitor for automated nonce-harvesting requests preceding the injection attempt.
→Affects WP Statistics plugin versions up to and including 13.1.5; flag installations of these versions in asset inventory for priority patching. ↗

·The Nuclei template digest/signature is embedded in the template itself; verify template integrity before deployment to avoid running tampered detection logic.
·The nonce extractor step is marked `internal: true`, meaning it is a prerequisite chained request and not a standalone detection; the full exploit requires two requests (nonce harvest + injection).

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.