CVE-2022-0651: WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpagetype parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0651?
CVE-2022-0651 is considered a high severity vulnerability due to its potential for SQL Injection attacks.
How do I fix CVE-2022-0651?
To fix CVE-2022-0651, update the WP Statistics plugin to version 13.1.6 or later where the vulnerability has been patched.
What is the impact of CVE-2022-0651?
The impact of CVE-2022-0651 allows unauthenticated attackers to execute arbitrary SQL queries on the affected WordPress site.
Which versions of WP Statistics are affected by CVE-2022-0651?
WP Statistics versions up to and including 13.1.5 are affected by CVE-2022-0651.
Is authentication required to exploit CVE-2022-0651?
No, CVE-2022-0651 can be exploited by attackers without any authentication.