CVE-2021-24340
high · 7.5A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
7.5
CVSS
29.8%
EPSS (exploit prob.)
98th
EPSS percentile
2021-06-07
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-89
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| veronalabs | wp_statistics | < 13.0.8 |
Check a specific version with /api/v1/cve/match.
References
- https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c
- https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/
- https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c
- https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-24340