WordPress Plugin Vulnerability Report – Burst Statistics and Burst Statistics Pro – Unauthenticated SQL Injection – CVE-2023-5761

What exactly is vulnerable in Burst Statistics?

The SQL injection vulnerability exists in the url parameter input field of the Burst Statistics plugin versions 1.4.0 to 1.4.6.1 (free version) and 1.4.0 to 1.5.0 (Burst Statistics Pro premium version). This field takes user input but does not properly sanitize and validate that input before using it to build database queries.

Attackers can inject malicious SQL code via the url parameter to modify the plugin's standard queries to extract data. No authentication is required to exploit this - any anonymous external party can send crafted url input payloads to pull sensitive information from the backend WordPress database.

Could customer data like emails or names be accessed in the exploit?

Yes - the SQL injection vulnerability provides unauthenticated access to WordPress' underlying MySQL databases. An attacker could extract admin credentials, customer emails, names, physical addresses, phone numbers, and any other registered user data stored in the WordPress tables.

Financial data would also be exposed if any payment or accounting plugins store related info in the databases. The level of sensitivity depends on what exactly each vulnerable Burst Statistics user has in their content management system.

Does this affect all sites or only some installations?

This specific SQL injection vulnerability only impacts sites running the Burst Statistics plugin, rather than all WordPress sites. However, given the broad popularity of the plugin with over 1 million downloads and 100,000+ active installs, a very large number of users face this security risk.

What WordPress versions work with vulnerable Burst Statistics?

The Burst Statistics plugin vulnerability spans WordPress 4.6 through the current 5.9.3 release for sites running the affected Burst Statistics plugin versions. The issue exists entirely within the plugin code itself - it is not dependent on the underlying WordPress core software.

So any WordPress site leveraging Burst Statistics version 1.4.0 up to 1.4.6.1 (free) or 1.4.0 up to 1.5.0 (Burst Statistics Pro paid) remains vulnerable, regardless of which WordPress release powers the content management system.

Is updating Burst Statistics enough or do I need a WordPress update too?

Updating the Burst Statistics plugin itself to a patched release that addresses the SQL injection vulnerability is sufficient. A WordPress core software update is not needed solely for remediating this particular security issue report.

However, given the perpetual evolution of vulnerabilities, users should confirm they run the latest stable WordPress alongside updating any plugins - including themes, other plugins popular for targets like contact form plugins. Comprehensively addressing all outdated software strengthens security posture.

What patched Burst Statistics versions fix this?

In the free Burst Statistics plugin, versions 1.4.0 to 1.4.6.1 contain the vulnerability. It was addressed in releases 1.5.0 and beyond.

For Burst Statistics Pro premium editions, versions 1.4.0 to 1.5.0 remain vulnerable. Version 1.5.1 patched the security flaw.

So free users should update to 1.5.0+ and Pro subscribers should move to 1.5.1+.

Are alternative analytics plugins safer options?

Open source alternatives like Simple Analytics, Plausible Analytics or Fathom Analytics avoid this direct exposure. However, vulnerabilities can arise in any plugin so opting for these other options does not guarantee absolute safety. Their popularity makes Burst a more common target.

Still, exploring them limits this particular attack vector. Their privacy focused models may appeal to some site owners too. As with all software, extra caution updating lesser known plugins even if their low risk today brings comfort.

How do I know if hackers exploited this on my Burst site?

It can prove extremely difficult to confirm historical exploitation of vulnerabilities. Attackers use sophisticated methods avoid detection or traces.

That said, IT staff should thoroughly comb through web server access logs during the window of exposure combined with close user/customer/internal communication monitoring for anomalies that could hint towards data extraction or malicious use enabled by this initial access vector.

Absence clear evidence does not confirm safety but continued vigilance remains vital. Make use of file integrity monitoring, endpoint detection and other advanced tools.

Is there any way to get notified about plugin vulnerabilities like this?

Absolutely - WordPress itself now offers automated security update emails to site administrators which encompass notifications around both new plugin updates and vulnerability disclosures relevant to an owner's specific plugins in us within their CMS.

Users can enable these security notifications in their profile settings space. This ensures plugin risks like Burst Statistics don't get overlooked between manual plugin scans. Automation takes one more item off an owner's plate.

For broader awareness, cybersecurity blogs and news sources reliably cover major WordPress plugin flaws and offer additional technical details as well as associated risks. Social media feeds of the WordPress platform account as well as reputable WordPress developers and agency partners rank as useful follows too.

What should I do if I suspect my site got hacked via this plugin flaw?

If audit logs, system changes, user complaints or other signs raise red flags of exploitation via this vector, prompt action becomes mission critical. Start by completely isolating the site through severing network connections to prevent further attacker activity as well as eliminate any channels for data exfiltration until containment occurs.

Consult experts in incident response to rapidly identify all compromised elements then execute remediation like rebuilding servers from scratch, resetting credentials, and restoring content from known good backups after scrubbing any possible malicious code injection across archives too. Move fast yet delicately to simultaneously address gaps while avoiding destroying key forensic evidence still needed for full-scale investigation. Breaches require eye for detail.