PT-2025-24031 · WordPress · Wp Online Users Stats

Rajan Kshedal · Published 2025-06-06 · Updated 2025-06-06 · CVE-2025-4964

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Online Users Stats plugin for WordPress versions up to and including 1.0.0

Description The issue allows authenticated attackers with Editor-level access or higher to inject additional SQL queries into existing ones, potentially extracting sensitive information from the database. This is due to insufficient escaping of the user-supplied table name parameter and lack of proper preparation of the existing SQL query.

Recommendations For WP Online Users Stats plugin for WordPress versions up to and including 1.0.0, consider disabling the table name parameter until a patch is available to prevent potential SQL injection attacks. Restrict access to the plugin's functionality to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-4964

Affected Products

Wp Online Users Stats

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-4964 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4964 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/a7ef66cf-ddf1-42be-82b1-cb6edcbf253c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-online-users-stats/trunk/admin/class-wp-online-users-stats-admin.php#L118 · Note
• https://t.me/cvetracker/25572 · Telegram Post
• https://wordpress.org/plugins/wp-online-users-stats/#developers · Note
• https://twitter.com/CVEnew/status/1930880583342919930 · Twitter Post