What’s Vulnerable › Vulnerabilities

CVE-2022-0513: WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 53.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-16 · updated 2026-06-17
• Weakness: CWE-89

Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.

Affected products

• WP Statistics: through 13.1.4

References

• https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.php
• https://www.wordfence.com/blog/2022/02/unauthenticated-sql-injection-vulnerability-patched-in-wordpress-statistics-plugin/
• https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.php
• https://www.wordfence.com/blog/2022/02/unauthenticated-sql-injection-vulnerability-patched-in-wordpress-statistics-plugin/

Get alerted when CVE-2022-0513 or the next vulnerability affects your stack