CVE-2022-25149: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the…

PriorityP276high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EXPLOIT

EPSS

77.96%

99.5th percentile

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
veronalabs	wp_statistics	<= 13.1.5	—
wp_statistics	wp_statistics	13.1.5 – 13.1.5	—

Detection & IOCsextracted from sources · hover to see the quote

path~/includes/class-wp-statistics-hits.php↗

→The vulnerability is an unauthenticated SQL injection via the IP parameter in the WP Statistics plugin. Monitor HTTP requests targeting the WP Statistics hit-recording endpoint for anomalous or SQL-crafted IP parameter values. ↗
→A successful exploitation attempt will return HTTP 200 with Content-Type application/json and a body containing 'Visitor Hit was recorded successfully'. Use this as a confirmation indicator in WAF/IDS logging.
→Exploitation requires a valid WordPress nonce (_wpnonce). Monitor for automated nonce extraction attempts (regex pattern '_wpnonce=([0-9a-zA-Z]+)') preceding injection requests, which may indicate a two-stage attack.
→Affected versions are WP Statistics up to and including 13.1.5. Flag any WordPress installations running this plugin version range for immediate patching and retrospective log review. ↗

·The SQL injection is unauthenticated, meaning no WordPress login is required. Any network-level control relying on authentication state will NOT block this attack vector. ↗
·The nonce extraction step is marked 'internal: true' in the nuclei template, meaning it is used internally by the PoC tool and is not directly observable as a separate outbound request in all scanning frameworks — defenders should still watch for nonce harvesting GET requests to the target WordPress pages.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.