Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-9315: Newstatpress plugin lets attackers alter database data

CVE-2015-9315 · published 7 years ago

Summary

The Newstatpress plugin for WordPress (versions before 1.0.1) can be tricked into running unintended database commands. This could let a malicious user change, view, or delete information stored by your site. Update the plugin to the latest version or remove it if you cannot upgrade.

What to do

Update newstatpress_project newstatpress to version 1.0.1 or later.

Affected software

Vendor	Product	Affected versions
newstatpress_project	newstatpress	< 1.0.1 `cpe:2.3:a:newstatpress_project:newstatpress::::::wordpress::*`

Original advisory text

The newstatpress plugin before 1.0.1 for WordPress has SQL injection.

References

https://wordpress.org/plugins/newstatpress/#developers Release Notes Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

2% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published14 Aug 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2015-9315 · NVD

Track software like this

Free during beta