# CVE-2022-0651: WP Statistics - SQLi

> Live exploitation tracking for CVE-2022-0651 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-0651

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** WP Statistics
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress

## Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

## CrowdSec analysis

[CVE-2022-0651](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-0651) is a critical SQL injection vulnerability in the WP Statistics WordPress plugin, affecting versions up to and including 13.1.5. This flaw allows unauthenticated attackers to inject arbitrary SQL queries via the current_page_type parameter, potentially exposing sensitive database information or enabling further attacks on the affected site.

CrowdSec has been tracking this vulnerability and its exploits since 21st of January 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2022-0651 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/wp-json/wp-statistics/v2/hit` endpoint by injecting SQL payloads into the `current_page_type` parameter, often using time-based techniques to extract sensitive data from vulnerable WordPress sites.

## Timeline

- 2022-02-24: CVE Published. CVE-2022-0651 is published to NVD.
- 2026-01-21: Rule Released. CrowdSec releases a rule to detect CVE-2022-0651 exploitation attempts against the CrowdSec Network.
- 2026-07-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-0651 for the first time.

## References

- https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0651.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-0651) follows observed exploitation activity for CVE-2022-0651. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.