CVE-2022-25149

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Affected

WP Statistics

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1 WORDFENCE

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

77.46% chance of exploitation in the next 30 days, 100th percentile

Nuclei

high · CWE-89

Published

2022-02-24

Updated

2025-01-31

Proof-of-concept exploits (1)

• https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25149.yaml

Security advisories

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%…
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25149

References

• CVE Record
• NVD entry