CVE-2021-24340
📋 TL;DR
This vulnerability in the WP Statistics WordPress plugin allows SQL injection attacks due to improper query preparation and insufficient input sanitization. The affected administrative page was also accessible to unauthenticated users, enabling attackers to execute arbitrary SQL commands. Over 600,000 WordPress sites using versions before 13.0.8 are affected.
💻 Affected Systems
- WP Statistics WordPress Plugin
📦 What is this software?
Wp Statistics by Veronalabs
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion; potential for remote code execution via SQL injection.
Likely Case
Unauthorized data access, privilege escalation, or database manipulation by attackers.
If Mitigated
Limited impact with proper input validation and access controls in place.
🎯 Exploit Status
The vulnerability is easily exploitable due to unauthenticated access and well-known SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.0.8
Vendor Advisory: https://wordpress.org/plugins/wp-statistics/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Statistics plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 13.0.8+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable WP Statistics Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate wp-statistics
Restrict Access via .htaccess
linuxBlock access to vulnerable endpoints using web server rules.
# Add to .htaccess:
<Files "wp-statistics.php">
Order Deny,Allow
Deny from all
</Files>
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection attempts
- Restrict network access to WordPress admin interfaces using IP whitelisting
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > WP Statistics version number. If version is below 13.0.8, you are vulnerable.Check Version:
wp plugin get wp-statistics --field=versionVerify Fix Applied:
Confirm WP Statistics plugin version is 13.0.8 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed authentication attempts to wp-statistics endpoints
- Unexpected database schema changes
Network Indicators:
- HTTP requests to /wp-content/plugins/wp-statistics/ with SQL injection patterns
- Unusual outbound database connections from web server
SIEM Query:
source="web_server" AND (uri="*wp-statistics*" AND (query="*SELECT*" OR query="*UNION*" OR query="*INSERT*" OR query="*DELETE*"))🔗 References
- https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c
- https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/
- https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c
- https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/
