Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2022-25149

CWE-89 — SQL Injection4 documents4 sources
Severity
7.5HIGH
EPSS
76.3%
top 1.07%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
WP Statistics WP StatisticsVeronalabs WP Statistics
Timeline
PublishedFeb 24
Latest updateFeb 25

Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5wp_statistics/wp_statistics13.1.5 — 13.1.5

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-gmjf-vvgp-p553: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~↗2022-02-25
▶
CVEList
WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP↗2022-02-24
▶

💥Exploits & PoCs

1
Nuclei
WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
▶