CVE-2022-25148
📋 TL;DR
This SQL injection vulnerability in the WP Statistics WordPress plugin allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can extract sensitive information from the database, including user credentials and other confidential data. All WordPress sites running vulnerable versions of WP Statistics are affected.
💻 Affected Systems
- WordPress WP Statistics Plugin
📦 What is this software?
Wp Statistics by Veronalabs
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to credential theft, data exfiltration, privilege escalation, and potential site takeover.
Likely Case
Extraction of sensitive user data, admin credentials, and plugin configuration information from the database.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing successful exploitation.
🎯 Exploit Status
Public exploit code available, requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.1.6 and later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Statistics and click 'Update Now'. 4. Verify version is 13.1.6 or higher.
🔧 Temporary Workarounds
Disable WP Statistics Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate wp-statistics
Web Application Firewall Rule
allBlock requests containing SQL injection patterns targeting current_page_id parameter
🧯 If You Can't Patch
- Implement strict input validation for current_page_id parameter
- Deploy web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check WP Statistics plugin version in WordPress admin panel under Plugins → Installed PluginsCheck Version:
wp plugin list --name=wp-statistics --field=versionVerify Fix Applied:
Confirm WP Statistics version is 13.1.6 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests with crafted current_page_id parameters
- Error logs showing SQL syntax errors
Network Indicators:
- HTTP requests with SQL injection payloads in current_page_id parameter
- Unusual traffic patterns to wp-statistics endpoints
SIEM Query:
source="web_logs" AND (uri_path="*wp-statistics*" AND query_string="*current_page_id*" AND (query_string="*UNION*" OR query_string="*SELECT*" OR query_string="*FROM*"))🔗 References
- http://packetstormsecurity.com/files/174482/WordPress-WP-Statistics-13.1.5-SQL-Injection.html
- https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148
- http://packetstormsecurity.com/files/174482/WordPress-WP-Statistics-13.1.5-SQL-Injection.html
- https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148
