CVE-2024-0405: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in burstbv Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative)
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'. This vulnerability arises due to insufficient escaping of user-supplied parameters and the lack of adequate preparation in SQL queries. As a result, authenticated attackers with editor access or higher can append additional SQL queries into existing ones, potentially leading to unauthorized access to sensitive information from the database.
AI Analysis
Technical Summary
The Burst Statistics WordPress plugin version 1.5.3 suffers from a post-authenticated SQL Injection vulnerability (CWE-89) in its REST API endpoint /wp-json/burst/v1/data/compare. Multiple JSON parameters ('browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer') are not properly sanitized or parameterized before being used in SQL queries. Attackers with editor-level or higher privileges can append arbitrary SQL commands, potentially exposing or modifying sensitive database data. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, and high impact on confidentiality, integrity, and availability.
Potential Impact
Exploitation allows authenticated users with editor or higher privileges to perform SQL Injection attacks, potentially leading to unauthorized disclosure, modification, or deletion of sensitive database information. This compromises the confidentiality, integrity, and availability of the affected system's data. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is released, restrict editor or higher access to trusted users only and consider disabling or removing the vulnerable plugin if possible to mitigate risk.
CVE-2024-0405: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in burstbv Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative)
Description
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'. This vulnerability arises due to insufficient escaping of user-supplied parameters and the lack of adequate preparation in SQL queries. As a result, authenticated attackers with editor access or higher can append additional SQL queries into existing ones, potentially leading to unauthorized access to sensitive information from the database.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Burst Statistics WordPress plugin version 1.5.3 suffers from a post-authenticated SQL Injection vulnerability (CWE-89) in its REST API endpoint /wp-json/burst/v1/data/compare. Multiple JSON parameters ('browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer') are not properly sanitized or parameterized before being used in SQL queries. Attackers with editor-level or higher privileges can append arbitrary SQL commands, potentially exposing or modifying sensitive database data. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, and high impact on confidentiality, integrity, and availability.
Potential Impact
Exploitation allows authenticated users with editor or higher privileges to perform SQL Injection attacks, potentially leading to unauthorized disclosure, modification, or deletion of sensitive database information. This compromises the confidentiality, integrity, and availability of the affected system's data. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is released, restrict editor or higher access to trusted users only and consider disabling or removing the vulnerable plugin if possible to mitigate risk.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-01-10T17:00:07.732Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 683dbfa6182aa0cae2498300
Added to database: 6/2/2025, 3:13:42 PM
Last enriched: 4/9/2026, 5:34:49 AM
Last updated: 5/10/2026, 6:36:52 AM
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.