CVE-2022-0651

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Affected

WP Statistics

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1 WORDFENCE

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

32.21% chance of exploitation in the next 30 days, 98th percentile

Nuclei

high · CWE-89

Published

2022-02-24

Updated

2025-01-31

Proof-of-concept exploits (1)

• https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0651.yaml

Security advisories

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%…
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0651

References

• CVE Record
• NVD entry