CVE-2023-0600
Published: 15 May 2023
Summary
CVE-2023-0600 is a critical-severity SQL Injection (CWE-89) vulnerability in Codepress Visitor Statistics. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is an SQL injection flaw (CWE-89) affecting the WP Visitor Statistics (Real Time Traffic) WordPress plugin prior to version 6.9. The root cause is missing escaping of user-supplied input that is directly concatenated into an SQL query, producing a critical-severity issue with a CVSS 3.1 score of 9.8.
Unauthenticated remote attackers can exploit the flaw over the network without any user interaction or credentials. Successful exploitation allows full read/write access to the database and can result in complete compromise of the confidentiality, integrity, and availability of the affected WordPress site.
Public references from WPScan document the issue and identify the vulnerable plugin versions, indicating that site owners should update to version 6.9 or later to eliminate the injection vector. The associated EPSS score remains elevated near its recorded peak of 0.7740 with a current value of 0.7558.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-12638
Vulnerability details
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.