Vulnerability · Published Feb 24, 2022 · Assigned by Wordfence

CVE-2022-25149WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP

Critical 9.8

In plain English

A critical-severity SQL injection in WP Statistics from WP Statistics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 77.5% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)77.5%top 0.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Affected products (as reported)

Vendor	Product	Versions
WP Statistics	WP Statistics	13.1.5 – through 13.1.5

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 x_refsource_MISC
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25149 x_refsource_MISC
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= x_refsource_MISC