The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c | Exploit Third Party Advisory |
| https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c | Exploit Third Party Advisory |
| https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 05:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c - Exploit, Third Party Advisory | |
| References | () https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/ - Exploit, Third Party Advisory |
Information
Published : 2021-06-07 11:15
Updated : 2024-11-21 05:52
NVD link : CVE-2021-24340
Mitre link : CVE-2021-24340
CVE.ORG link : CVE-2021-24340
JSON object : View
Products Affected
veronalabs
- wp_statistics
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')