SQL Injection Vulnerability in WP Statistics Plugin

Using WordPress for your project? You need to be conscious of security. SQL Injection Vulnerability in WP Statistics Plugin Discovered!

I received a mail today, as part of a vulnerability research project by Sucuri. A WP plugin has been confirmed to be vulnerable as Sucuri discovered an SQL injection vulnerability in WP Statistics.

WP Statistics is one of the most popular WordPress statistic open source. It keep record of visitor statistics on WordPress. I use google analytics instead, so I don’t use WPStatistic. But over 300,000 users currently have WS installed on their site.

WS track visitors stats for wp sites without depending on other external services. Such as google analytic. It also uses a take over data to respect visitors and user’s privacy.

If You Have WS Plugin Installed On Your WordPress, You May Be At Risk!


 Any WP user who uses a vulnerable old version of WP Statistics and allows user registration on their website might be at risk.

Below Is The Vulnerability Details:


Base of the nature of SQL Injection attacks, the discovery shows that there are many ways hackers can cause a big harm to wp site. This could result to leak out password, and also hijack a logged in user’s while attackers could gain access to your sites. The technical details of this vulnerability disclosure can be found here.

This is more reason why its important for you to update your WordPress plugin when the need arises. Update your plugin as soon as possible if you currently have the old WS version installed on your site.

What is Sucuri all about?

Sucuri In. is a global security platform for any type of websites. They monitor for web security incidents, attacks and also focus and specialize on WordPress website security as a service with free and premium plugin.

Tags: WordPress Security

No related post!

Leave a reply "SQL Injection Vulnerability in WP Statistics Plugin"