CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2021-24340
High (7.5) in veronalabs wp statistics. EPSS 30% chance of exploitation in the next 30 days.
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
Severity
- EPSS
- 30% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- veronalabs:wp_statistics
References
- https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c
- https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/
- https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c
- https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/