cve/2022/CVE-2022-25149.md

### [CVE-2022-25149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25149)
![](https://img.shields.io/static/v1?label=Product&message=WP%20Statistics&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=13.1.5%3C%3D%2013.1.5%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brighgreen)

### Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

### POC

#### Reference
- https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042

#### Github
No PoCs found on GitHub currently.