WP Statistics before 12.0.8 concatenates the page/post ID and the search engine name into SQL queries without sanitising them. A user who can supply these values, for example through the [wpstatistics] shortcode attributes id and provider (any logged-in user can render shortcodes via the parse-media-shortcode AJAX action), can inject SQL and read data from the WordPress database. Fixed in 12.0.8.
This vulnerability affects the following application versions:
- WP Statistics 6.0
- WP Statistics 6.1
- WP Statistics 7.0
- WP Statistics 7.0.1
- WP Statistics 7.0.2
- WP Statistics 7.0.3
- WP Statistics 7.0.4
- WP Statistics 7.1
- WP Statistics 7.2
- WP Statistics 7.3
- WP Statistics 7.4
- WP Statistics 8.0
- WP Statistics 8.1
- WP Statistics 8.1.1
- WP Statistics 8.2
- WP Statistics 8.3
- WP Statistics 8.3.1
- WP Statistics 8.4
- WP Statistics 8.5
- WP Statistics 8.5.1
- WP Statistics 8.6
- WP Statistics 8.6.1
- WP Statistics 8.6.2
- WP Statistics 8.6.3
- WP Statistics 8.7
- WP Statistics 8.7.1
- WP Statistics 8.7.2
- WP Statistics 8.8
- WP Statistics 8.8.1
- WP Statistics 9.0
- WP Statistics 9.1
- WP Statistics 9.1.1
- WP Statistics 9.1.2
- WP Statistics 9.1.3
- WP Statistics 9.2
- WP Statistics 9.3
- WP Statistics 9.3.1
- WP Statistics 9.4
- WP Statistics 9.4.1
- WP Statistics 9.5
- WP Statistics 9.5.1
- WP Statistics 9.5.2
- WP Statistics 9.5.3
- WP Statistics 9.6
- WP Statistics 9.6.1
- WP Statistics 9.6.2
- WP Statistics 9.6.3
- WP Statistics 9.6.4
- WP Statistics 9.6.5
- WP Statistics 9.6.6
- WP Statistics 9.7
- WP Statistics 10.0
- WP Statistics 10.0.1
- WP Statistics 10.0.2
- WP Statistics 10.0.3
- WP Statistics 10.0.4
- WP Statistics 10.0.5
- WP Statistics 10.1
- WP Statistics 10.2
- WP Statistics 10.3
- WP Statistics 11.0
- WP Statistics 11.0.1
- WP Statistics 11.0.2
- WP Statistics 11.0.3
- WP Statistics 12.0
- WP Statistics 12.0.1
- WP Statistics 12.0.2
- WP Statistics 12.0.3
- WP Statistics 12.0.4
- WP Statistics 12.0.5
- WP Statistics 12.0.6
- WP Statistics 12.0.7