Slimstat Analytics
CVE-2026-54818
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Network-reachable WordPress endpoint (AV:N), straightforward SQLi (AC:L), requires authenticated low-priv account (PR:L); plugin SQLi reaches core WP DB so S:C, with high confidentiality and limited integrity/availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection.
This issue affects Slimstat Analytics: from n/a through 5.4.11.
AnalysisAI
Blind SQL injection in VeronaLabs Slimstat Analytics WordPress plugin through version 5.4.11 allows authenticated low-privileged users to inject SQL commands via improperly neutralized input. The CVSS 8.5 score reflects scope change (S:C) impacting the broader WordPress database beyond the plugin context, with high confidentiality impact and partial availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with at least low privileges (PR:L - typically subscriber or contributor role) on a target site running VeronaLabs Slimstat Analytics through version 5.4.11. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) indicates network-exploitable, low-complexity attack requiring authenticated low-privileged access - consistent with WordPress subscriber or contributor accounts which are commonly available on sites with open registration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a low-privileged WordPress account (or compromises an existing subscriber/contributor credential) on a site running Slimstat Analytics ≤ 5.4.11, then sends crafted requests to a vulnerable plugin endpoint with blind SQLi payloads (boolean or time-based) to enumerate the WordPress database. Through iterative inference, the attacker extracts administrator password hashes from wp_users and session tokens or API keys from wp_usermeta/wp_options, enabling full site takeover via offline hash cracking or session hijacking. |
| Remediation | Patch available per vendor advisory - upgrade Slimstat Analytics to a version newer than 5.4.11 as soon as the vendor releases a fixed version (consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-slimstat/vulnerability/wordpress-slimstat-analytics-plugin-5-4-11-sql-injection-vulnerability for the exact fix version). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct inventory of all WordPress installations to identify active use of Slimstat Analytics v5.4.11 or earlier; document user counts and privilege levels for each affected site. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Share
External POC / Exploit Code
Leaving vuln.today