CVE-2022-0651
Published: 24 February 2022
Summary
CVE-2022-0651 is a critical-severity SQL Injection (CWE-89) vulnerability in Veronalabs Wp Statistics. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The WP Statistics WordPress plugin is vulnerable to SQL injection in versions up to and including 13.1.5. The flaw stems from insufficient escaping and parameterization of the current_page_type parameter in the file includes/class-wp-statistics-hits.php, which permits construction of arbitrary SQL queries. The issue is tracked as CWE-89 and carries a CVSS 3.1 base score of 9.8.
Unauthenticated attackers with network access can supply malicious input to the affected parameter and execute SQL queries against the database. Successful exploitation can yield sensitive information stored by the plugin and, given the high impact metrics, may allow modification or deletion of data as well.
Public references point to a patched changeset on the WordPress plugin repository and an advisory from Wordfence that describe the remediation. Site administrators should update the WP Statistics plugin to a version newer than 13.1.5. The associated EPSS score has remained at 0.6938 since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15745
Vulnerability details
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in…
more
versions up to and including 13.1.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.