Burst Statistics for WordPress SQL injection

Technical summary

Burst Statistics is a privacy-focused analytics plugin for WordPress. Its REST endpoint /wp-json/burst/v1/data/compare accepts several JSON parameters — the record names browser, device, page_id, page_url, platform and referrer — and uses them in SQL without neutralising them.

The two published scores disagree on the bar: Wordfence puts privileges required at high and scores 7.2, while NVD puts it at low with confidentiality-only impact and scores 6.5. Both vectors are shown above; we publish them as published rather than picking one.

Impact

An authenticated user can read data from the WordPress database through the analytics endpoint, well beyond the aggregate statistics the endpoint is meant to return.

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'.

Remediation

The vendor patch is visible in the plugin’s changeset, linked below. The published record does not name a fixed version number, so none is stated here.

Disclosure timeline

1. 2024-01-05Vendor notified
2. 2024-01-16Disclosed
3. 2024-01-17CVE record published

Dates as recorded in the CVE record’s own timeline field. See the record.

References

• NVD entry
• CVE record (MITRE)
• Wordfence advisory
• Vendor patch (WordPress plugin changeset)

We publish advisories, not exploits. Each entry describes the vulnerability class and impact at the level the vendor advisory does, and links to the authoritative records. Where public proof-of-concept code exists we link to it rather than reproduce it.