WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type
55Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.8epss 33%
exploitation probability
33%top 2% of all CVEs
observed exploitation
nono source reports it
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
WP Statistics · WP Statistics