SQL Injection Vulnerability in WP Online Users Stats Plugin by WordPress

CVE-2025-4964

What is CVE-2025-4964?

The WP Online Users Stats plugin for WordPress is susceptible to time-based SQL Injection through the 'table_name' parameter across all versions up to and including 1.0.0. This vulnerability arises due to inadequate escaping of user-supplied parameters and insufficient preparation in the SQL queries. As a result, authenticated attackers with Editor-level access or higher can inject additional SQL queries, potentially leading to unauthorized extraction of sensitive information from the database.

References