CVE-2023-5761 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SQL Injection (SQLi) in WordPress Plugin Burst Statistics. 💥 **Consequences**: Attackers can steal, modify, or delete database data. Full site compromise is possible due to high CVSS score.

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Insufficient escaping of user-supplied parameters. 🔍 **CWE**: Not explicitly listed, but classic **SQL Injection** flaw. Input validation failed.

Q: Who is affected? (Versions/Components)

📦 **Affected**: WordPress Plugin **Burst Statistics**. 📅 **Versions**: **1.4.0** through **1.4.6.1**. 👤 **Vendor**: rogierlankhorst.

Q: What can hackers do? (Privileges/Data)

🕵️ **Attacker Actions**: Execute arbitrary SQL commands. 🔓 **Impact**: High Confidentiality, Integrity, and Availability loss. Can access sensitive user data or admin credentials.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 📊 **CVSS**: AV:N/AC:L/PR:N/UI:N. 🚫 **No Auth Required**: Exploitable remotely without login. Easy to exploit.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🧪 **Public Exploit**: No specific PoC listed in data. 🌐 **References**: WordFence and Trac links provided. Likely exploitable given 'AC:L' and 'PR:N'.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for **Burst Statistics** plugin version. 📋 **Verify**: Check if version is between **1.4.0** and **1.4.6.1**. 🛠️ **Tools**: Use WordPress security scanners or manual version check.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. 📝 **Patch**: Update to version **1.4.6.2** or later (implied by range end). 🔗 **Source**: WordPress Trac changeset provided.

Q: What if no patch? (Workaround)

🚧 **No Patch Workaround**: Disable the plugin immediately. 🔒 **Mitigation**: Remove plugin if not needed. 🛡️ **WAF**: Use Web Application Firewall to block SQLi patterns.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: Patch immediately. 📉 **Risk**: High CVSS score + No Auth needed = High likelihood of automated exploitation.

Updated May 08, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SQL Injection (SQLi) in WordPress Plugin Burst Statistics. <br>💥 **Consequences**: Attackers can steal, modify, or delete database data. Full site compromise is possible due to high CVSS score.

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Insufficient escaping of user-supplied parameters. <br>🔍 **CWE**: Not explicitly listed, but classic **SQL Injection** flaw. Input validation failed.

Q3Who is affected? (Versions/Components)

📦 **Affected**: WordPress Plugin **Burst Statistics**. <br>📅 **Versions**: **1.4.0** through **1.4.6.1**. <br>👤 **Vendor**: rogierlankhorst.

Q4What can hackers do? (Privileges/Data)

🕵️ **Attacker Actions**: Execute arbitrary SQL commands. <br>🔓 **Impact**: High Confidentiality, Integrity, and Availability loss. Can access sensitive user data or admin credentials.

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>📊 **CVSS**: AV:N/AC:L/PR:N/UI:N. <br>🚫 **No Auth Required**: Exploitable remotely without login. Easy to exploit.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🧪 **Public Exploit**: No specific PoC listed in data. <br>🌐 **References**: WordFence and Trac links provided. Likely exploitable given 'AC:L' and 'PR:N'.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for **Burst Statistics** plugin version. <br>📋 **Verify**: Check if version is between **1.4.0** and **1.4.6.1**. <br>🛠️ **Tools**: Use WordPress security scanners or manual version check.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. <br>📝 **Patch**: Update to version **1.4.6.2** or later (implied by range end). <br>🔗 **Source**: WordPress Trac changeset provided.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: Disable the plugin immediately. <br>🔒 **Mitigation**: Remove plugin if not needed. <br>🛡️ **WAF**: Use Web Application Firewall to block SQLi patterns.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>🚨 **Priority**: Patch immediately. <br>📉 **Risk**: High CVSS score + No Auth needed = High likelihood of automated exploitation.

Continue exploring

Vulnerability detail Full AI analysis (login) rogierlankhorst