WP Statistics < 14.0 - Authenticated SQLi

CVE-2023-0955

Summary

The WP Statistics plugin for WordPress, prior to version 14.0, has a vulnerability that allows authenticated users to exploit unsanitized input parameters to execute SQL Injection attacks. Although the feature is primarily accessible to users with administrative privileges (manage_options capability), settings within the plugin permit lower-privileged users to access it, thereby expanding the attack surface. This vulnerability emphasizes the importance of validating and sanitizing user inputs to prevent unauthorized data manipulation.

References