CVE-2023-0955
High
Description
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
SeverityHigh
CVSS8.8
Exploit probability—
ProductVeronalabs Wp Statistics
PublishedMar 27, 2023
First seenMar 27, 2023
Weakness typeCWE-89SQL injection
How to fix
Update
- veronalabs wp_statistics14.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| veronalabs wp_statistics | v < 14.0 | 14.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.