CVE-2022-25149

Deeper analysis

The WP Statistics WordPress plugin is vulnerable to SQL injection in versions up to and including 13.1.5. The flaw stems from insufficient escaping and parameterization of the IP parameter in the file ~/includes/class-wp-statistics-hits.php, which permits construction of arbitrary SQL queries. The issue is tracked as CWE-89 and carries a CVSS 3.1 base score of 9.8.

Unauthenticated attackers with network access can supply a crafted IP value to the affected endpoint, enabling direct execution of injected SQL statements against the backend database. Successful exploitation can result in disclosure of sensitive information as well as modification or deletion of data, consistent with the high impact ratings across confidentiality, integrity, and availability.

Public references point to a fix committed in the WordPress plugin repository (changeset 2679983) and to a detailed advisory published by Wordfence. Site administrators should update the WP Statistics plugin to a version newer than 13.1.5; the referenced changeset and Wordfence advisory contain the specific remediation steps applied by the vendor.

The EPSS score for this CVE has remained at 0.7626 since disclosure, indicating sustained but not newly emerging exploitation interest.