Now officially on WordPress.org

CVE Database / CVE-2024-0405

CVE · Medium

CVE-2024-0405 — Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) [burst-statistics] < 1.5.4

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-0405 Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) [burst-statistics] < 1.5.4 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Medium 6.5 < 1.5.4 1.5.4 2024-01-16 —

CVE-2024-0405

The Burst Statistics plugin before version 1.5.4 contains a post-authenticated SQL injection flaw in its /wp-json/burst/v1/data/compare endpoint, where parameters such as browser, device, page_id, page_url, platform, and referrer are not properly escaped in database queries. An authenticated user with editor-level permissions or above could exploit this weakness to inject malicious SQL and retrieve sensitive data from the WordPress database. The vulnerability stems from inadequate input validation and unprotected SQL query construction.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings