CVE-2021-24340: WP Statistics < 13.0.8 - Unauthenticated SQL Injection
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress escsql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-24340.
What is the severity of CVE-2021-24340?
The severity of CVE-2021-24340 is high (7.5).
What does the WP Statistics WordPress plugin rely on?
The WP Statistics WordPress plugin relies on using the WordPress esc_sql() function on a field not delimited by quotes.
What is the affected version of the WP Statistics WordPress plugin?
The affected version of the WP Statistics WordPress plugin is up to (but not including) 13.0.8.
Who had access to the vulnerable page?
The vulnerable page, which should have been accessible to administrators only, was also available to any visitor, including unauthorized users.
Are there any references for further information?
Yes, you can find more information about CVE-2021-24340 at the following references: [WPScan](https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c) and [Wordfence](https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/).
What is the CWE category of this vulnerability?
The CWE category of this vulnerability is CWE-89.