Medium severity · published Mar 7, 2023
CVE-2021-4333
The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WP Statistics · Veronalabs
through 13.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4333
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4333
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2626597%40wp-statistics&new=2626597%40wp-statistics&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/215937d9-739b-4198-b375-6d171bbac64a?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/215937d9-739b-4198-b375-6d171bbac64a
More from WP Statistics
9.8
CVE-2022-25148
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the…
9.8
CVE-2017-18515
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection
9.8
CVE-2019-13275
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress
8.8
CVE-2023-0955
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks
8.8
CVE-2022-38074
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions