WordPress WP Online Users Stats plugin <= 1.0.0 - SQL Injection vulnerability

The SQL Injection vulnerability in WP Online Users Stats allows an attacker to bypass authentication and execute arbitrary SQL queries. This can result in the extraction of sensitive user data, including usernames, passwords, email addresses, and potentially other personally identifiable information (PII) stored in the WordPress database. Successful exploitation could also allow an attacker to modify or delete data, leading to data corruption or denial of service. The blind nature of the injection means the attacker doesn't see the results of the query directly, requiring more sophisticated techniques to extract data, but significantly increasing the potential impact if successful.

Websites using the WP Online Users Stats plugin, particularly those running older, unpatched versions (0–1.0.0), are at significant risk. Shared hosting environments where multiple websites share the same database are particularly vulnerable, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r "wp_online_users_stats" /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep wp-online-users-stats

• wordpress / composer / npm:

curl -I <wordpress_url>/wp-content/plugins/wp-online-users-stats/readme.txt | grep Version

1. 2025-04-11Disclosure

   disclosure

1. 已保留2025-04-09
2. 发布日期2025-04-11
3. 修改日期2026-04-28
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-32603 is to immediately update the WP Online Users Stats plugin to version 1.0.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily disabling the plugin to prevent exploitation. While a direct WAF rule is difficult to implement due to the blind nature of the injection, monitoring database query logs for unusual patterns or unexpected SQL commands originating from the plugin's endpoint can provide an early warning. Regularly review and update WordPress security plugins and themes to minimize the overall attack surface.