CVE-2022-25149criticalCWE-89

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP

65Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 9.8epss 78%

probabilidad de explotación

78%top 1% de las CVE

explotación observada

noninguna fuente lo reporta

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

WP Statistics · WP Statistics

Referencias

https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25149