WP Statistics < 13.2.9 - Authenticated SQLi

CVE-2022-4230

Summary

The WP Statistics plugin for WordPress, prior to version 13.2.9, is vulnerable to SQL Injection due to improper escaping of a parameter. This vulnerability allows authenticated users to exploit the affected feature. By default, this feature is restricted to users with the manage_options capability (typically administrators); however, it can also be configured to be accessible to lower-privileged users, thereby increasing the risk of unauthorized database access and manipulation. This flaw highlights the importance of keeping WordPress plugins up-to-date and following security best practices to mitigate potential threats.

References