HTTP: WordPress WP Statistics Plugin SQL Injection

This signature detects attempts to exploit a known vulnerability against WordPress WP Statistics Plugin. A successful attack can lead to command injection and arbitrary code execution.

Extended Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Affected Products

Veronalabs wp_statistics

References

CVE: CVE-2022-4230

URL: https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148 https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0651 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-statistics/wp-statistics-1328-authenticated-admin-sql-injection

Short Name

HTTP:SQL:INJ:WP-STATISTICS

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: WordPress WP Statistics Plugin SQL Injection

Extended Description

Affected Products

References

Found a potential security threat?