What’s Vulnerable › Vulnerabilities

CVE-2019-13275

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-04 · updated 2026-06-17
• Weakness: CWE-89

Description

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection.

Affected products

• WP Statistics: through 12.6.6

References

• https://github.com/wp-statistics/wp-statistics/commit/bd46721b97794a1b1520e24ff5023b6da738dd75
• https://wordpress.org/plugins/wp-statistics/#developers
• https://wpvulndb.com/vulnerabilities/9412
• https://github.com/wp-statistics/wp-statistics/commit/bd46721b97794a1b1520e24ff5023b6da738dd75
• https://wordpress.org/plugins/wp-statistics/#developers
• https://wpvulndb.com/vulnerabilities/9412

Get alerted when CVE-2019-13275 or the next vulnerability affects your stack