What is the CVSS score of CVE-2026-54818?

CVE-2026-54818 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Slimstat Analytics are affected by CVE-2026-54818?

VeronaLabs Slimstat Analytics WordPress plugin versions through 5.4.11 contain a blind SQL injection vulnerability (CVSS 8.5) that allows low-privileged authenticated users to execute arbitrary SQL…

How to fix or mitigate CVE-2026-54818?

Within 24 hours: Conduct inventory of all WordPress installations to identify active use of Slimstat Analytics v5.4.11 or earlier; document user counts and privilege levels for each affected site. Within 7 days: Either (1) deactivate the plugin pending patch release, (2) restrict plugin access to administrator accounts only to eliminate low-privilege exploitation vector, or (3) implement WAF rules blocking SQL injection patterns in requests to the plugin's known vulnerable endpoints. Within 30 days: Monitor VeronaLabs and Patchstack for patch availability; establish weekly remediation status review until fully patched.

Slimstat Analytics CVE-2026-54818

HIGH

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Slimstat Analytics Wordpress Plugin Veronalabs

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.1 CRITICAL

Network-reachable WordPress endpoint (AV:N), straightforward SQLi (AC:L), requires authenticated low-priv account (PR:L); plugin SQLi reaches core WP DB so S:C, with high confidentiality and limited integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:23 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection.

This issue affects Slimstat Analytics: from n/a through 5.4.11.

AnalysisAI

Blind SQL injection in VeronaLabs Slimstat Analytics WordPress plugin through version 5.4.11 allows authenticated low-privileged users to inject SQL commands via improperly neutralized input. The CVSS 8.5 score reflects scope change (S:C) impacting the broader WordPress database beyond the plugin context, with high confidentiality impact and partial availability impact. No public exploit identified at time of analysis, but the WordPress plugin ecosystem and Patchstack reporting suggest discovery through standard SQLi testing.

Technical ContextAI

Slimstat Analytics is a popular WordPress analytics plugin maintained by VeronaLabs that tracks visitor data and stores it in the WordPress MySQL database. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements in SQL Commands), meaning user-supplied input is concatenated into SQL queries without proper sanitization or parameterization. As a blind SQL injection, the attacker cannot see direct query output but extracts data through inferential techniques such as boolean-based or time-based payloads. The CPE cpe:2.3:a:veronalabs:slimstat_analytics:*:*:*:*:*:*:*:* confirms all versions through 5.4.11 are affected.

RemediationAI

Patch available per vendor advisory - upgrade Slimstat Analytics to a version newer than 5.4.11 as soon as the vendor releases a fixed version (consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-slimstat/vulnerability/wordpress-slimstat-analytics-plugin-5-4-11-sql-injection-vulnerability for the exact fix version). As compensating controls until patching, restrict WordPress user registration to disable creation of low-privileged accounts (Settings → General → uncheck 'Anyone can register'), audit existing low-privileged accounts and remove unused ones, and deploy a WordPress-aware WAF rule (such as Patchstack or Wordfence) to block SQLi payloads against Slimstat plugin endpoints - note that WAF rules may produce false positives on legitimate analytics traffic. Temporarily deactivating the Slimstat plugin eliminates the attack surface but causes loss of analytics data collection.