The SlimStat Analytics plugin for WordPress suffers from a time-based SQL Injection vulnerability in the 'args' parameter in all versions up to 5.3.1. The root cause is insufficient escaping of user-supplied input and lack of prepared statements in the SQL query construction. Authenticated attackers with Subscriber-level privileges or higher can exploit this to append arbitrary SQL commands, potentially extracting sensitive data from the database. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting medium severity with network attack vector, low attack complexity, and requiring privileges. No patch or official remediation guidance is currently available.

Successful exploitation allows an authenticated user with Subscriber-level access or above to perform time-based SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is rated high. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor for suspicious activity related to the SlimStat Analytics plugin. Avoid using affected versions of the plugin in sensitive environments.