CVE-2021-24340— WP Statistics < 13.0.8 - Unauthenticated SQL Injection
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-24340
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Statistics < 13.0.8 - Unauthenticated SQL Injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress 插件SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress是Wordpress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress 插件是WordPress开源的一个应用插件。 Wordpress Statistics 存在SQL注入漏洞，该漏洞允许远程攻击者在数据库中执行任意SQL查询。以下产品及版本受影响:WP Statistics 1.0、2.0、2.1、2.1.1、2.1.2、2.1.3、2.1.4、2.1.5、2.1.6、2.2.0、2.2.1、2.2.2、2.2.3、
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| VeronaLabs | WP Statistics | 13.0.8 ~ 13.0.8 | - |
II. Public POCs for CVE-2021-24340
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | WordPress Statistic plugin versions prior to version 13.0.8 are affected by an unauthenticated time-based blind SQL injection vulnerability. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24340.yaml | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24340
请登录查看更多情报信息。
- https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19cx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2021-24340
IV. Related Vulnerabilities
Same product: WP Statistics
- CVE-2025-55716
WordPress WP Statistics Plugin <= 14.15 - Broken Access Cont - CVE-2023-0955
WP Statistics < 14.0 - Authenticated SQLi - CVE-2022-38074
WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to S - CVE-2022-4230
WP Statistics < 13.2.9 - Authenticated SQLi - CVE-2022-27231
WordPress plugin WP Statistics 跨站脚本漏洞
Same vendor: VeronaLabs
- CVE-2026-3488
WP Statistics <= 14.16.4 - Missing Authorization to Authenti - CVE-2026-5231
WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site - CVE-2026-1238
SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-S - CVE-2026-28136
WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerabil - CVE-2025-69323
WordPress Slimstat Analytics plugin <= 5.3.2 - Reflected Cro
Same weakness: CWE-89
- CVE-2021-47941
WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss - CVE-2021-47930
Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthentic - CVE-2021-47928
Opencart TMD Vendor System 3.x Blind SQL Injection via produ - CVE-2026-8231
CodeAstro Online Catering Ordering System deleteorder.php sq - CVE-2025-14179
SQL injection in pdo_firebird via NUL bytes in quoted string
V. Comments for CVE-2021-24340
No comments yet