Security readout for executives and security teams
Plain-English summary
This CVE concerns a SQL injection flaw in the Kama Click Counter WordPress plugin version 3.4.9. The issue is tied to the admin.php order parameter. SQL injection can expose or alter database data, but the provided sources do not state impact scope, required privileges, CVSS score, or a fixed version.
Executive priority
Prioritize this when the plugin is present on production WordPress sites, especially sites storing sensitive customer or operational data. If the plugin is absent, no direct exposure is indicated by the provided sources.
Technical view
CVE-2017-18614 describes SQL injection in kama-clic-counter 3.4.9 for WordPress through the admin.php order parameter. The source bundle provides no CVSS, CWE, authentication requirements, exploit maturity, patch version, or detailed impact analysis. A Full Disclosure reference and the WordPress plugin developers page are listed.
Likely exposure
Exposure appears limited to WordPress sites with the Kama Click Counter plugin version 3.4.9 installed. The affected-product metadata is incomplete, so confirmation requires local plugin inventory rather than relying on CPE matching.
Exploitation context
The vulnerability was publicly disclosed, but the source bundle does not identify active exploitation. KEV status is false, so do not treat this as confirmed exploited in the wild based on the provided evidence.
Researcher notes
The CVE description names a concrete plugin and parameter, but metadata is sparse. Avoid assumptions about authentication, exploitability, database impact, or remediation version until confirmed through the linked advisory and vendor plugin history.
Mitigation direction
- Inventory WordPress sites for Kama Click Counter version 3.4.9.
- Check the WordPress plugin developers page for vendor guidance or later versions.
- Disable or remove the plugin if no supported fixed version is available.
- Limit WordPress admin access to trusted users and networks where feasible.
- Back up the site and database before plugin changes.
Validation and detection
- Confirm installed plugin name and version from WordPress administration or asset inventory.
- Review whether any site still serves the affected plugin.
- Check administrative logs for unusual admin.php order parameter activity.
- Verify vendor guidance before declaring a patched state.
- Record compensating controls if the plugin cannot be removed immediately.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-18614 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wordpress.org/plugins/kama-clic-counter/#developersCVE reference · x_refsource_MISC
- https://seclists.org/fulldisclosure/2017/Feb/67CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.