CVE-2021-24340

    Dashboard / Vulnerabilities / CVE-2021-24340

    CVE-2021-24340

    Published: 7 Jun 2021Last Modified: 9 Jul 2026

    Summary:

    Details: The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.

    References: https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c, https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5eec022858a125e75bec3b1196b19a6d2bd5f04e

    Affected versions

    13.0.7
    13.0.5
    13.0.4
    13.0.3
    13.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-24340 | CVE-DB