CVE-2024-13321

Description

The AnalyticsWP plugin for WordPress is vulnerable to SQL Injection via the 'custom_sql' parameter in all versions up to, and including, 2.0.0 due to insufficient authorization checks on the handle_get_stats() function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Reserved 2025-01-09 | Published 2025-03-14 | Updated 2025-03-14 | Assigner Wordfence

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

*
affected

Timeline

2025-03-13:

Disclosed

Credits

Trương Hữu Phúc (truonghuuphuc) finder

References

www.wordfence.com/...-92c0-457c-8c87-2d023428a77f?source=cve

analyticswp.com/

cve.org (CVE-2024-13321)

nvd.nist.gov (CVE-2024-13321)

Download JSON