PT-2025-16083 · WordPress · Wp Online Users Stats

Tran Nguyen Bao Khanh · Published 2025-04-11 · Updated 2025-04-12 · CVE-2025-32603

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions: WP Online Users Stats versions prior to 1.0.0

Description: The issue is related to the improper neutralization of special elements used in an SQL command, allowing for Blind SQL Injection. This can be exploited through API endpoints, although specific endpoints are not mentioned. Vulnerable parameters or variables, such as username or password, are not explicitly specified. The general issue of SQL Injection involves manipulating SQL commands to access or modify sensitive data.

Recommendations: For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to SQL commands or disabling any features that may be vulnerable to SQL Injection until a patch is available. Avoid using user-supplied input in SQL commands without proper sanitization.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-32603

Affected Products

Wp Online Users Stats

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-32603 · Security Note
• https://twitter.com/CVEnew/status/1910622955702251859 · Twitter Post
• https://twitter.com/threatsbank/status/1911072294010495198 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/wp-online-users-stats/vulnerability/wordpress-wp-online-users-stats-plugin-1-0-0-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/cybercronai/status/1910928517027479640 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/wp-online-users-stats/vulnerability/wordpress-wp-online-users-stats-plugin-1-0-0-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1910619897140334901 · Twitter Post
• https://t.me/cvetracker/21392 · Telegram Post