CVE-2023-5761: SQL Injection in Burst Statistics WordPress Plugin

The SQL Injection vulnerability in Burst Statistics allows attackers to directly manipulate database queries. By injecting malicious SQL code through the 'url' parameter, an attacker can bypass security measures and gain access to sensitive information stored within the WordPress database. This could include user credentials, plugin configuration data, and potentially other sensitive application data. Successful exploitation could lead to complete database compromise and unauthorized access to the entire WordPress site. The lack of authentication required for exploitation significantly broadens the attack surface, making it a high-priority risk.

1. Reserved2023-10-25
2. Published2023-12-07
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-5761 is to immediately upgrade the Burst Statistics plugin to a patched version. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider temporarily disabling the plugin to prevent further exploitation. Web Application Firewalls (WAFs) configured to detect and block SQL Injection attempts targeting the 'url' parameter can provide an additional layer of defense. Review WordPress access logs for suspicious SQL queries originating from external sources. After upgrading, confirm the fix by attempting to inject a simple SQL query through the 'url' parameter and verifying that it is properly sanitized and does not execute.

Active installs

200KNiche

Plugin rating

4.9

Requires WordPress

6.6+

Compatible up to

7.0

Requires PHP

8.0+