Vulnerability · Published Apr 5, 2021 · Assigned by WPScan
CVE-2021-24167Web-Stat < 1.4.1 - API Key Disclosure
High 7.5
In plain English
A high-severity information exposure in Web-Stat from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.4%top 27.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookup_WP_account.
Affected products (as reported)
Weakness: CWE-200
References
- https://wpscan.com/vulnerability/e7326903-1552-4934-a611-fc0b43236d60 x_refsource_CONFIRM