What’s Vulnerable › Vulnerabilities

CVE-2023-5640: Article Analytics <= 1.0 - Unauthenticated SQL injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-11-20 · updated 2026-06-17
• Weakness: CWE-89

Description

The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection vulnerability.

Affected products

• Article analytics: through 1.0

References

• https://devl00p.github.io/posts/Injection-SQL-dans-le-plugin-Wordpress-Article-Analytics/
• https://wpscan.com/vulnerability/9a383ef5-0f1a-4894-8f78-845abcb5062d
• https://devl00p.github.io/posts/Injection-SQL-dans-le-plugin-Wordpress-Article-Analytics/
• https://wpscan.com/vulnerability/9a383ef5-0f1a-4894-8f78-845abcb5062d

Get alerted when CVE-2023-5640 or the next vulnerability affects your stack