CVE-2021-4333 WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation

What is CVE-2021-4333?

CVE-2021-4333 is a medium-severity vulnerability in veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative, published on 7 Mar 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2021-4333?

It affects 1 product.

Products include Veronalabs Wp Statistics.

How do I fix CVE-2021-4333?

No fix has been published for CVE-2021-4333 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-4333 being exploited?

There is no known exploitation of CVE-2021-4333 in the wild and no public exploit code.

Other vulnerabilities in veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative

• CVE-2022-38074 WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection Critical 9.9
• CVE-2022-0651 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type Critical 9.8
• CVE-2022-25148 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id Critical 9.8
• CVE-2022-25149 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP Critical 9.8
• CVE-2022-0513 WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-34rv-84qc-vrr9.