CVE-2022-25148: WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id

Q: What is CVE-2022-25148?

CVE-2022-25148 is a vulnerability in the WP Statistics WordPress plugin that allows SQL Injection attacks due to insufficient escaping and parameterization of the current_page_id parameter.

Q: How severe is CVE-2022-25148?

CVE-2022-25148 has a severity rating of critical, with a CVSS score of 9.8.

Q: How does CVE-2022-25148 affect the WP Statistics WordPress plugin?

CVE-2022-25148 affects WP Statistics plugin versions up to and including 13.1.5.

Q: What can an attacker do with CVE-2022-25148?

An attacker without authentication can exploit CVE-2022-25148 to inject arbitrary SQL queries, potentially obtaining sensitive information.

Q: Is there a fix for CVE-2022-25148?

Yes, upgrading to a version of the WP Statistics plugin that is not affected by CVE-2022-25148, such as a patched or newer version, is recommended.

Published Feb 24, 2022

Updated

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpageid parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Credit

psychoSherlock

Affected Software

1 affected component

VeronaLabs Wp Statistics Wordpress<=13.1.5

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=

Information

Update to version 13.1.6 or newer.

Event History

Feb 24, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

RemedyDescriptionSeverityWeakness

Sep 4, 2023

Exploit Published

12:00 AM

Known Exploited

12:00 AM

Frequently Asked Questions

What is CVE-2022-25148?