CVE-2025-32603: SQL Injection in WP Online Users Stats

The SQL Injection vulnerability in WP Online Users Stats allows an attacker to bypass authentication and execute arbitrary SQL queries. This can result in the extraction of sensitive user data, including usernames, passwords, email addresses, and potentially other personally identifiable information (PII) stored in the WordPress database. Successful exploitation could also allow an attacker to modify or delete data, leading to data corruption or denial of service. The blind nature of the injection means the attacker doesn't see the results of the query directly, requiring more sophisticated techniques to extract data, but significantly increasing the potential impact if successful.

1. Reserved2025-04-09
2. Published2025-04-11
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-32603 is to immediately update the WP Online Users Stats plugin to version 1.0.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily disabling the plugin to prevent exploitation. While a direct WAF rule is difficult to implement due to the blind nature of the injection, monitoring database query logs for unusual patterns or unexpected SQL commands originating from the plugin's endpoint can provide an early warning. Regularly review and update WordPress security plugins and themes to minimize the overall attack surface.