{"id":"CVE-2022-0513","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-0513","generatedAt":"2026-11-05T00:40:51.483Z","title":"The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without…","description":"The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the \"Record Exclusions\" option to be enabled on the vulnerable site.","published":"2022-02-16T17:15:12.000Z","lastModified":"2026-06-17T04:20:45.000Z","status":"Modified","sourceIdentifier":"security@wordfence.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-89"],"affected":["veronalabs/wp statistics"],"epss":{"score":0.5346,"percentile":0.98992,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 53.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.php","tags":["Patch","Third Party Advisory"],"source":"security@wordfence.com"},{"url":"https://www.wordfence.com/blog/2022/02/unauthenticated-sql-injection-vulnerability-patched-in-wordpress-statistics-plugin/","tags":["Exploit","Patch","Third Party Advisory"],"source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.php","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.wordfence.com/blog/2022/02/unauthenticated-sql-injection-vulnerability-patched-in-wordpress-statistics-plugin/","tags":["Exploit","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-0513","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}