CVE-2022-0513

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-05146.5Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.CVE-2022-05154.3Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.CVE-2022-05167.8A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw CVE-2022-05177.8Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage th CVE-2022-05187.1Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.CVE-2022-05197.1Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.CVE-2022-05207.8Use After Free in NPM radare2.js prior to 5.6.2.CVE-2022-05217.1Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.CVE-2022-05227.1Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.CVE-2022-05237.8Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.CVE-2022-05247.5Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.CVE-2022-05259.1Out-of-bounds Read in Homebrew mruby prior to 3.2.