WP Statistics < 13.0.8 - Unauthenticated SQL Injection
Priority MEDIUM 56CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
Why it matters now
EPSS 0.29776 98th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed WP Statistics (VeronaLabs): 13.0.8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VeronaLabs | WP Statistics | 13.0.8 to before 13.0.8 | 13.0.8 | Patch available | CNA |
- WP Statistics VendorVeronaLabs Affected 13.0.8 to before 13.0.8 Fixed in 13.0.8 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:* | before 13.0.8 | Vulnerable | VeronaLabs |
- cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:* Versions before 13.0.8 Vulnerable ·VeronaLabs
Remediation
- Fix · CNA WP Statistics (VeronaLabs) Fixed in 13.0.8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24340
- 2026-10-03 Alias added: GHSA-9mj4-xv45-qwq2
References
More VeronaLabs Wp Statistics vulnerabilities
- TI-2022-08862 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP CVSS 3.1CRITICAL 9.8
- TI-2022-08861 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id CVSS 3.1CRITICAL 9.8
- TI-2022-00433 WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason CVSS 3.1CRITICAL 9.8
- TI-2022-08998 WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP CVSS 3.1HIGH 7.2
- TI-2023-00906 WP Statistics < 14.0 - Authenticated SQLi CVSS 3.1HIGH 8.8
- TI-2022-03873 WP Statistics < 13.2.9 - Authenticated SQLi CVSS 3.1HIGH 8.8
Sources
- CVE-2021-24340 · CVE Program
- CVE-2021-24340 · NVD
- FIRST EPSS
- GHSA-9mj4-xv45-qwq2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences