CVE-2022-0513: WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusionreason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0513?
CVE-2022-0513 is classified as a high severity vulnerability due to its potential for SQL Injection.
How do I fix CVE-2022-0513?
To fix CVE-2022-0513, update the WP Statistics plugin to version 13.1.5 or later.
What can attackers do with CVE-2022-0513?
Attackers can exploit CVE-2022-0513 to execute arbitrary SQL queries on the affected WordPress site.
Is authentication required to exploit CVE-2022-0513?
No, exploitation of CVE-2022-0513 does not require authentication, making it particularly dangerous.
What versions of the WP Statistics plugin are affected by CVE-2022-0513?
CVE-2022-0513 affects all versions of the WP Statistics plugin up to and including 13.1.4.