CVE-2022-0513
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform SQL injection attacks on WordPress sites running the WP Statistics plugin with 'Record Exclusions' enabled. Attackers can extract sensitive database information including user credentials and site data. All WordPress sites using WP Statistics versions up to 13.1.4 are affected.
💻 Affected Systems
- WP Statistics WordPress Plugin
📦 What is this software?
Wp Statistics by Veronalabs
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to credential theft, data exfiltration, and potential site takeover via privilege escalation.
Likely Case
Extraction of sensitive user data, admin credentials, and potentially database manipulation.
If Mitigated
Limited impact with proper input validation and database permissions in place.
🎯 Exploit Status
SQL injection via exclusion_reason parameter requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.1.5
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Statistics and click 'Update Now'. 4. Verify version is 13.1.5 or higher.
🔧 Temporary Workarounds
Disable Record Exclusions
allTemporarily disable the vulnerable feature until patching is possible.
Web Application Firewall Rule
allBlock requests containing SQL injection patterns targeting the exclusion_reason parameter.
🧯 If You Can't Patch
- Disable the WP Statistics plugin completely
- Implement strict input validation and parameterized queries at application level
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > WP Statistics version. If version is 13.1.4 or lower and 'Record Exclusions' is enabled, site is vulnerable.Check Version:
wp plugin list --name=wp-statistics --field=versionVerify Fix Applied:
Verify WP Statistics plugin version is 13.1.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests with SQL-like patterns in exclusion_reason parameter
- Failed authentication attempts following SQL injection patterns
Network Indicators:
- HTTP POST requests to wp-statistics endpoints with SQL payloads in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND (exclusion_reason CONTAINS "UNION" OR exclusion_reason CONTAINS "SELECT" OR exclusion_reason CONTAINS "INSERT")🔗 References
- https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.php
- https://www.wordfence.com/blog/2022/02/unauthenticated-sql-injection-vulnerability-patched-in-wordpress-statistics-plugin/
- https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.php
- https://www.wordfence.com/blog/2022/02/unauthenticated-sql-injection-vulnerability-patched-in-wordpress-statistics-plugin/
