Vulnerability record · CVE-2022-25149 · published 24 February 2022
CVE-2022-25149: WP Statistics plugin unauthenticated SQL injection via IP parameter
Veronalabs · Wp Statistics
The WP Statistics WordPress plugin fails to escape and parameterize the IP parameter in includes/class-wp-statistics-hits.php, allowing unauthenticated SQL injection in versions up to and including 13.1.5. Because the plugin is widely deployed and the flaw is reachable without credentials, it exposes site databases to direct query manipulation.
Description
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated network-reachable SQL injection with high confidentiality impact and very high EPSS, though not in KEV and limited to data disclosure.
What it is
The WP Statistics WordPress plugin fails to escape and parameterize the IP parameter in includes/class-wp-statistics-hits.php, allowing unauthenticated SQL injection in versions up to and including 13.1.5. Because the plugin is widely deployed and the flaw is reachable without credentials, it exposes site databases to direct query manipulation.
Impact
An attacker can inject arbitrary SQL to read sensitive data from the WordPress database, including user credentials, configuration and plugin data. The CVSS vector shows high confidentiality impact with no integrity or availability effect.
Attack surface
Reachable over the network through the plugin's hit-tracking endpoint that processes the IP parameter; no authentication and no user interaction are required per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Not listed in CISA KEV, but EPSS is very high at 0.775 (99.5th percentile) and public exploit code is referenced, indicating active interest and likely exploitation.
What to do
- Update WP Statistics to a version later than 13.1.5, which contains the patch referenced in the plugin changeset.
- If immediate patching is not possible, disable or remove the WP Statistics plugin until it can be updated.
- Deploy a WAF rule blocking SQL injection patterns on requests carrying the IP parameter to the plugin's hit-tracking endpoint.
- Restrict database account privileges used by WordPress to the minimum required to limit data exposure from successful injection.
Detection
- Review web server and WAF logs for requests to WP Statistics hit-tracking paths containing SQL keywords, quotes or comment sequences in the IP parameter.
- Monitor database query logs for anomalous SELECT statements or UNION constructs originating from the WordPress application.
- Audit WordPress user and option tables for unexpected changes or exfiltration indicators following suspicious plugin endpoint traffic.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 | ExploitThird Party Advisory |
| https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40w | PatchThird Party Advisory |
| https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25149 | Third Party Advisory |
| https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 | ExploitThird Party Advisory |
| https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40w | PatchThird Party Advisory |
| https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25149 | Third Party Advisory |
Track CVE-2022-25149 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-25149), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
