CVE-2023-5041: Track The Click < 0.3.12 - Author+ Time-Based Blind SQL Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-17 · updated 2026-06-17
Weakness: CWE-89

Description

The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.

Affected products

Track The Click: before 0.3.12 — fixed in 0.3.12

How to fix

Upgrade to a fixed version: Track The Click 0.3.12. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/45194442-6eea-4e07-85a5-4a1e2fde3523
https://wpscan.com/vulnerability/45194442-6eea-4e07-85a5-4a1e2fde3523

Get alerted when CVE-2023-5041 or the next vulnerability affects your stack