CVE-2021-24340

CVE-2021-24340 is a critical blind SQL injection vulnerability affecting the WP Statistics WordPress plugin prior to version 13.0.8. This flaw allowed unauthenticated attackers to exploit improper SQL sanitization and access an administrator-only page, leading to potential data exfiltration. With a CVSS score of 7.5 (High) and an EPSS score indicating significant exploitability, it presents a severe risk due to its low attack complexity and high impact on confidentiality. While not listed in CISA's KEV catalog, public Nuclei templates exist for exploitation, and it has garnered community discussion and media coverage, suggesting awareness among threat actors.