CVE-2024-13321

High

Published: 14 March 2025

Published

14 March 2025

Modified

21 March 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0012 30.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13321 is a high-severity SQL Injection (CWE-89) vulnerability in Analyticswp Analyticswp. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-13321 is a SQL injection vulnerability in the AnalyticsWP plugin for WordPress, affecting all versions up to and including 2.0.0. The issue stems from insufficient authorization checks in the handle_get_stats() function, which allows the 'custom_sql' parameter to be abused. This enables attackers to append additional SQL queries to existing ones, facilitating the extraction of sensitive information from the database. The vulnerability is classified under CWE-89 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity, requiring no user privileges or interaction. Exploitation allows remote extraction of confidential database information, such as user credentials or other sensitive data stored in WordPress sites running the plugin, without impacting integrity or availability.

Mitigation details are available in advisories from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/f6507318-92c0-457c-8c87-2d023428a77f?source=cve and the plugin's official site at https://analyticswp.com/.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-6412

Vulnerability details

The AnalyticsWP plugin for WordPress is vulnerable to SQL Injection via the 'custom_sql' parameter in all versions up to, and including, 2.0.0 due to insufficient authorization checks on the handle_get_stats() function. This makes it possible for unauthenticated attackers to append…

additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing WordPress plugin enables remote unauthenticated exploitation of web applications (T1190) and direct unauthorized data collection from databases (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0