CVE-2024-0405

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'. This vulnerability arises due to insufficient escaping of user-supplied parameters and the lack of adequate preparation in SQL queries. As a result, authenticated attackers with editor access or higher can append additional SQL queries into existing ones, potentially leading to unauthorized access to sensitive information from the database.

• CWE-89
• CWE-89
• CWE-89

• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/statistics/class-statistics.php?rev=3011996#L380Issue Tracking
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/statistics/class-statistics.php?rev=3011996#L926Issue Tracking
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3020809%40burst-statistics%2Ftrunk&old=3012004%40burst-statistics%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e349f07d-a520-4700-a6e0-25e68c1deeae?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/statistics/class-statistics.php?rev=3011996#L380Issue Tracking
• https://plugins.trac.wordpress.org/browser/burst-statistics/trunk/statistics/class-statistics.php?rev=3011996#L926Issue Tracking
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3020809%40burst-statistics%2Ftrunk&old=3012004%40burst-statistics%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e349f07d-a520-4700-a6e0-25e68c1deeae?source=cveThird Party Advisory

Published

Jan 17, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0399The WooCommerce Customers Manager WordPress plugin before 29…8.1
• CVE-2024-0400SCM Software is a client and server application. An Authenti…7.5
• CVE-2024-0401ASUS routers supporting custom OpenVPN profiles are vulnerab…7.2
• CVE-2024-0402An issue has been discovered in GitLab CE/EE affecting all v…9.9
• CVE-2024-0403Recipes version 1.5.10 allows arbitrary HTTP requests to be …6.5
• CVE-2024-0404A mass assignment vulnerability exists in the `/api/invite/:…9.1
• CVE-2024-0406A flaw was discovered in the mholt/archiver package. This fl…7.8
• CVE-2024-0407Certain HP Enterprise LaserJet, and HP LaserJet Managed Prin…6.5
• CVE-2024-0408A flaw was found in the X.Org server. The GLX PBuffer code d…5.5
• CVE-2024-0409A flaw was found in the X.Org server. The cursor code in bot…7.8
• CVE-2024-0410An authorization bypass vulnerability was discovered in GitL…7.7
• CVE-2024-0411A vulnerability was found in DeShang DSMall up to 6.1.0. It …7.5