CVE-2024-0405highCWE-89

CVE-2024-0405: high-severity vulnerability in burstbv Burst Statistics – Privacy-Friendly…

Burst Statistics Really Simple Plugins <= 1.5.3 - Authenticated (Editor+) SQL Injection

Published · Updated

Follow this CVE+ Monitor Burst Statistics – Privacy-Friendly WordPress Analytics

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.6%
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'. This vulnerability arises due to insufficient escaping of user-supplied parameters and the lack of adequate preparation in SQL queries. As a result, authenticated attackers with editor access or higher can append additional SQL queries into existing ones, potentially leading to unauthorized access to sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
burstbv · Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative)
Related CVEs — burstbv Burst Statistics – Privacy-Friendly…

In the same product, most dangerous first.

CVE-2026-8181CRITICALBurst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account TakeoverEPSS 14.6%CVE-2024-1894MEDIUMBurst Statistics – Privacy-Friendly Analytics for WordPress <= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_countEPSS 0.5%