CVE-2025-13431
Time-Based SQL Injection in SlimStat Analytics WordPress Plugin
Publication date: 2026-02-11
Last updated on: 2026-02-11
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp-slimstat | wp-slimstat | to 5.3.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "The vulnerability in CVE-2025-13431 affects the SlimStat Analytics plugin for WordPress, specifically versions up to and including 5.3.1. It is a time-based SQL Injection vulnerability that occurs via the 'args' parameter. This happens because the plugin does not properly escape user-supplied input and fails to sufficiently prepare the SQL query. As a result, authenticated users with Subscriber-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database."}, {'type': 'paragraph', 'content': 'The vulnerability is related to the Chart.php file, which handles generating statistical charts based on user data. Although the plugin implements nonce verification and input sanitization for AJAX requests, the flaw lies in the handling or validation of input parameters or SQL query construction, allowing unauthorized data access or manipulation.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability allows authenticated users with Subscriber-level access or above to perform time-based SQL Injection attacks. Through this, attackers can append malicious SQL queries to existing ones, enabling them to extract sensitive information from the WordPress site's database."}, {'type': 'paragraph', 'content': 'The impact includes unauthorized disclosure of sensitive data stored in the database, which could compromise user privacy, site integrity, and potentially lead to further exploitation depending on the data accessed.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability involves a time-based SQL Injection via the 'args' parameter in the SlimStat Analytics WordPress plugin, specifically in versions up to 5.3.1. Detection involves monitoring for suspicious SQL injection attempts targeting the AJAX endpoint that fetches chart data."}, {'type': 'paragraph', 'content': "Since the vulnerability can be exploited by authenticated users with Subscriber-level access or higher, detection can include reviewing web server logs or WordPress logs for unusual POST requests to the AJAX handler related to SlimStat, especially those containing suspicious 'args' parameter values."}, {'type': 'paragraph', 'content': 'Suggested commands to detect potential exploitation attempts include:'}, {'type': 'list_item', 'content': "Using grep to search web server logs for suspicious AJAX requests: grep -i 'wp-admin/admin-ajax.php' /var/log/apache2/access.log | grep 'slimstat'"}, {'type': 'list_item', 'content': 'Searching for SQL injection patterns in logs: grep -iE "(union|select|sleep|benchmark|--|#)" /var/log/apache2/access.log'}, {'type': 'list_item', 'content': 'Monitoring database slow query logs for unusual time-based delays that may indicate time-based SQL injection attempts.'}, {'type': 'paragraph', 'content': 'Additionally, verifying the plugin version installed on your WordPress site can help detect if the vulnerable version is present.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include updating the SlimStat Analytics plugin to a version later than 5.3.1 where this vulnerability is fixed.'}, {'type': 'paragraph', 'content': "If an update is not immediately possible, restrict access to the plugin's AJAX endpoints to trusted users only, and consider disabling the plugin temporarily to prevent exploitation."}, {'type': 'paragraph', 'content': 'Additionally, review and strengthen user access controls to ensure that only trusted users have Subscriber-level or higher access.'}, {'type': 'paragraph', 'content': "Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts targeting the 'args' parameter in SlimStat plugin requests."}] [1]