PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats…
Priority LOW 38CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter.
Why it matters now
EPSS 0.02819 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 67
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* | all versions | Running on | WordPress |
| cpe:2.3:a:firestats:firestats:*:stable:*:*:*:*:*:* | up to 1.6.1 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:0.9.0-beta:*:*:*:*:*:*:* | 0.9.0-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:0.9.1-beta:*:*:*:*:*:*:* | 0.9.1-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:0.9.2-beta:*:*:*:*:*:*:* | 0.9.2-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:0.9.3-beta:*:*:*:*:*:*:* | 0.9.3-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:0.9.4-beta:*:*:*:*:*:*:* | 0.9.4-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:0.9.5-beta:*:*:*:*:*:*:* | 0.9.5-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:0.9.6-beta:*:*:*:*:*:*:* | 0.9.6-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:0.9.7-beta:*:*:*:*:*:*:* | 0.9.7-beta | Vulnerable | Firestats |
- cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* Versions all versions Running on ·WordPress
- cpe:2.3:a:firestats:firestats:*:stable:*:*:*:*:*:* Versions up to 1.6.1 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:0.9.0-beta:*:*:*:*:*:*:* Versions 0.9.0-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:0.9.1-beta:*:*:*:*:*:*:* Versions 0.9.1-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:0.9.2-beta:*:*:*:*:*:*:* Versions 0.9.2-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:0.9.3-beta:*:*:*:*:*:*:* Versions 0.9.3-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:0.9.4-beta:*:*:*:*:*:*:* Versions 0.9.4-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:0.9.5-beta:*:*:*:*:*:*:* Versions 0.9.5-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:0.9.6-beta:*:*:*:*:*:*:* Versions 0.9.6-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:0.9.7-beta:*:*:*:*:*:*:* Versions 0.9.7-beta Vulnerable ·Firestats
Show 57 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:firestats:firestats:0.9.8-beta:*:*:*:*:*:*:* | 0.9.8-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:0.9.9:*:*:*:*:*:*:* | 0.9.9 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.0.0:rc1:*:*:*:*:*:* | 1.0.0 rc1 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.0.1:rc2:*:*:*:*:*:* | 1.0.1 rc2 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.0.2:rc3:*:*:*:*:*:* | 1.0.2 rc3 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.0.2:stable:*:*:*:*:*:* | 1.0.2 stable | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.1.1:rc1:*:*:*:*:*:* | 1.1.1 rc1 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.1.2:rc2:*:*:*:*:*:* | 1.1.2 rc2 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.1.3:rc3:*:*:*:*:*:* | 1.1.3 rc3 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.1.3:rc4:*:*:*:*:*:* | 1.1.3 rc4 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.1.4:rc5:*:*:*:*:*:* | 1.1.4 rc5 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.1.5:stable:*:*:*:*:*:* | 1.1.5 stable | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.1.6:stable:*:*:*:*:*:* | 1.1.6 stable | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.1.7:stable:*:*:*:*:*:* | 1.1.7 stable | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.1.8:stable:*:*:*:*:*:* | 1.1.8 stable | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.2.0-beta:*:*:*:*:*:*:* | 1.2.0-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.2.1:rc1:*:*:*:*:*:* | 1.2.1 rc1 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.2.2:rc2:*:*:*:*:*:* | 1.2.2 rc2 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.2.3:rc3:*:*:*:*:*:* | 1.2.3 rc3 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.2.4:stable:*:*:*:*:*:* | 1.2.4 stable | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.3.0-beta:*:*:*:*:*:*:* | 1.3.0-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.3.1-beta:*:*:*:*:*:*:* | 1.3.1-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.3.2-beta:*:*:*:*:*:*:* | 1.3.2-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.3.3-beta:*:*:*:*:*:*:* | 1.3.3-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.3.4:rc1:*:*:*:*:*:* | 1.3.4 rc1 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.3.5:rc2:*:*:*:*:*:* | 1.3.5 rc2 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.3.6:stabe:*:*:*:*:*:* | 1.3.6 stabe | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.4:*:*:*:*:*:*:* | 1.4 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.4.0-beta:*:*:*:*:*:*:* | 1.4.0-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.4.1-beta:*:*:*:*:*:*:* | 1.4.1-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.4.2-beta:*:*:*:*:*:*:* | 1.4.2-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.4.3:rc1:*:*:*:*:*:* | 1.4.3 rc1 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.4.4:stable:*:*:*:*:*:* | 1.4.4 stable | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5:*:*:*:*:*:*:* | 1.5 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.0-beta:*:*:*:*:*:*:* | 1.5.0-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.1-beta:*:*:*:*:*:*:* | 1.5.1-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.2-beta:*:*:*:*:*:*:* | 1.5.2-beta | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.3:rc1:*:*:*:*:*:* | 1.5.3 rc1 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.4:rc2:*:*:*:*:*:* | 1.5.4 rc2 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.5:rc3:*:*:*:*:*:* | 1.5.5 rc3 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.7:rc1:*:*:*:*:*:* | 1.5.7 rc1 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.8:rc2:*:*:*:*:*:* | 1.5.8 rc2 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.9:rc3:*:*:*:*:*:* | 1.5.9 rc3 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.10:rc4:*:*:*:*:*:* | 1.5.10 rc4 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.11:stable:*:*:*:*:*:* | 1.5.11 stable | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.5.12:stable:*:*:*:*:*:* | 1.5.12 stable | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.6:*:*:*:*:*:*:* | 1.6 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.6.0:*:*:*:*:*:*:* | 1.6.0 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.6.0:rc1:*:*:*:*:*:* | 1.6.0 rc1 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.6.0:rc2:*:*:*:*:*:* | 1.6.0 rc2 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.6.0:rc3:*:*:*:*:*:* | 1.6.0 rc3 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.6.0:rc4:*:*:*:*:*:* | 1.6.0 rc4 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.6.0:stable:*:*:*:*:*:* | 1.6.0 stable | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.6.0-beta1:*:*:*:*:*:*:* | 1.6.0-beta1 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.6.0-beta2:*:*:*:*:*:*:* | 1.6.0-beta2 | Vulnerable | Firestats |
| cpe:2.3:a:firestats:firestats:1.6.1:*:*:*:*:*:*:* | 1.6.1 | Vulnerable | Firestats |
- cpe:2.3:a:firestats:firestats:0.9.8-beta:*:*:*:*:*:*:* Versions 0.9.8-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:0.9.9:*:*:*:*:*:*:* Versions 0.9.9 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.0.0:rc1:*:*:*:*:*:* Versions 1.0.0 rc1 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.0.1:rc2:*:*:*:*:*:* Versions 1.0.1 rc2 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.0.2:rc3:*:*:*:*:*:* Versions 1.0.2 rc3 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.0.2:stable:*:*:*:*:*:* Versions 1.0.2 stable Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.1.1:rc1:*:*:*:*:*:* Versions 1.1.1 rc1 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.1.2:rc2:*:*:*:*:*:* Versions 1.1.2 rc2 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.1.3:rc3:*:*:*:*:*:* Versions 1.1.3 rc3 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.1.3:rc4:*:*:*:*:*:* Versions 1.1.3 rc4 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.1.4:rc5:*:*:*:*:*:* Versions 1.1.4 rc5 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.1.5:stable:*:*:*:*:*:* Versions 1.1.5 stable Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.1.6:stable:*:*:*:*:*:* Versions 1.1.6 stable Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.1.7:stable:*:*:*:*:*:* Versions 1.1.7 stable Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.1.8:stable:*:*:*:*:*:* Versions 1.1.8 stable Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.2.0-beta:*:*:*:*:*:*:* Versions 1.2.0-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.2.1:rc1:*:*:*:*:*:* Versions 1.2.1 rc1 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.2.2:rc2:*:*:*:*:*:* Versions 1.2.2 rc2 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.2.3:rc3:*:*:*:*:*:* Versions 1.2.3 rc3 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.2.4:stable:*:*:*:*:*:* Versions 1.2.4 stable Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.3.0-beta:*:*:*:*:*:*:* Versions 1.3.0-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.3.1-beta:*:*:*:*:*:*:* Versions 1.3.1-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.3.2-beta:*:*:*:*:*:*:* Versions 1.3.2-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.3.3-beta:*:*:*:*:*:*:* Versions 1.3.3-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.3.4:rc1:*:*:*:*:*:* Versions 1.3.4 rc1 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.3.5:rc2:*:*:*:*:*:* Versions 1.3.5 rc2 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.3.6:stabe:*:*:*:*:*:* Versions 1.3.6 stabe Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.4.0-beta:*:*:*:*:*:*:* Versions 1.4.0-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.4.1-beta:*:*:*:*:*:*:* Versions 1.4.1-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.4.2-beta:*:*:*:*:*:*:* Versions 1.4.2-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.4.3:rc1:*:*:*:*:*:* Versions 1.4.3 rc1 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.4.4:stable:*:*:*:*:*:* Versions 1.4.4 stable Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.0-beta:*:*:*:*:*:*:* Versions 1.5.0-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.1-beta:*:*:*:*:*:*:* Versions 1.5.1-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.2-beta:*:*:*:*:*:*:* Versions 1.5.2-beta Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.3:rc1:*:*:*:*:*:* Versions 1.5.3 rc1 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.4:rc2:*:*:*:*:*:* Versions 1.5.4 rc2 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.5:rc3:*:*:*:*:*:* Versions 1.5.5 rc3 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.7:rc1:*:*:*:*:*:* Versions 1.5.7 rc1 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.8:rc2:*:*:*:*:*:* Versions 1.5.8 rc2 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.9:rc3:*:*:*:*:*:* Versions 1.5.9 rc3 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.10:rc4:*:*:*:*:*:* Versions 1.5.10 rc4 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.11:stable:*:*:*:*:*:* Versions 1.5.11 stable Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.5.12:stable:*:*:*:*:*:* Versions 1.5.12 stable Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.6.0:rc1:*:*:*:*:*:* Versions 1.6.0 rc1 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.6.0:rc2:*:*:*:*:*:* Versions 1.6.0 rc2 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.6.0:rc3:*:*:*:*:*:* Versions 1.6.0 rc3 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.6.0:rc4:*:*:*:*:*:* Versions 1.6.0 rc4 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.6.0:stable:*:*:*:*:*:* Versions 1.6.0 stable Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.6.0-beta1:*:*:*:*:*:*:* Versions 1.6.0-beta1 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.6.0-beta2:*:*:*:*:*:*:* Versions 1.6.0-beta2 Vulnerable ·Firestats
- cpe:2.3:a:firestats:firestats:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Firestats
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2009-2143
- 2026-10-03 Alias added: GHSA-vvrc-262j-cc4f
References
Exploit 1
More Firestats vulnerabilities
- TI-2009-02051 SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress… CVSS 2.0HIGH 7.5
Sources
- CVE-2009-2143 · CVE Program
- CVE-2009-2143 · NVD
- FIRST EPSS
- GHSA-vvrc-262j-cc4f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences