CVE-2022-0513

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.

• CWE-89
• CWE-89

• https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.phpPatch, Third Party Advisory
• https://www.wordfence.com/blog/2022/02/unauthenticated-sql-injection-vulnerability-patched-in-wordpress-statistics-plugin/Exploit, Patch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.phpPatch, Third Party Advisory
• https://www.wordfence.com/blog/2022/02/unauthenticated-sql-injection-vulnerability-patched-in-wordpress-statistics-plugin/Exploit, Patch, Third Party Advisory

Published

Feb 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0507Found a potential security vulnerability inside the Pandora …8.8
• CVE-2022-0508Server-Side Request Forgery (SSRF) in GitHub repository choc…5.3
• CVE-2022-0509Cross-site Scripting (XSS) - Stored in Packagist pimcore/pim…5.4
• CVE-2022-0510Cross-site Scripting (XSS) - Reflected in Packagist pimcore/…5.4
• CVE-2022-0511Mozilla developers and community members Gabriele Svelto, Se…8.8
• CVE-2022-0512Authorization Bypass Through User-Controlled Key in NPM url-…5.3
• CVE-2022-0514Business Logic Errors in GitHub repository crater-invoice/cr…6.5
• CVE-2022-0515Cross-Site Request Forgery (CSRF) in GitHub repository crate…4.3
• CVE-2022-0516A vulnerability was found in kvm_s390_guest_sida_op in the a…7.8
• CVE-2022-0517Mozilla VPN can load an OpenSSL configuration file from an u…7.8
• CVE-2022-0518Heap-based Buffer Overflow in GitHub repository radareorg/ra…7.1
• CVE-2022-0519Buffer Access with Incorrect Length Value in GitHub reposito…7.1