CVE-2022-25148

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Affected

WP Statistics

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1 WORDFENCE

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

80.93% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-89

Published

2022-02-24

Updated

2024-08-03

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/174482/WordPress-WP-Statistics-13.1.5-SQL-Injection…
• https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25148.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51711

Security advisories

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%…
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148

References

• CVE Record
• NVD entry