HarborGuardharborguardDatabase
Back to search
HIGHCVE-2026-54818Published Modified CNA Patchstack

CVE-2026-54818: WordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection. This issue affects Slimstat Analytics: from n/a through 5.4.11.

Metrics

CVSS v3.1
8.5
Severity
HIGH
Fixed in
—
Affected Products
1

Get notified

Email me when this CVE is updated: new fix versions, severity changes, or any record change.

HarborGuard Analysis

Synopsis

A SQL injection vulnerability affects the VeronaLabs Slimstat Analytics WordPress plugin at version 5.4.11 and earlier. The flaw is reachable over the network by any authenticated user with a low-privilege account, and no victim interaction is needed to trigger it. Successful exploitation allows an attacker to run blind SQL queries against the underlying database, reading sensitive data and partially disrupting service availability. No fix version has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment upstream ships a corrected release.

HarborGuard Coverage

Detection

Detection for CVE-2026-54818 is available across every HarborGuard environment: the CVE is ingested from upstream feeds, including the Patchstack advisory, within minutes of publication and matched against all customer images, including custom-built WordPress images that bundle the Slimstat Analytics plugin. Any image in a connected registry or CI pipeline containing a vulnerable version of the plugin is flagged automatically.

Available
Triage

HarborGuard is capable of scoring this finding at CVSS 8.5 HIGH and weighting it against each environment's compliance policy to determine urgency and routing. Alerts are directed to the appropriate team inbox within each customer organization based on configured ownership rules and severity thresholds.

Available
Patch

Because no upstream fix version has been published for this CVE, HarborGuard re-checks the Patchstack and NVD advisory feeds on every ingest cycle and will make a patched-image rebuild available automatically the moment a corrected plugin release is published. In the interim, customers with auto-remediation enabled can apply compensating-control policies such as network-policy isolation for affected workloads.

Pending upstream

Exploit Conditions

  • Network reachabilityRequired

    The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

  • AuthenticationRequired

    Any low-privilege WordPress account is sufficient; no administrator or elevated role is needed to trigger the injection.

  • Victim interactionNot required

    The attacker can send a crafted request directly without needing any action from another user or an administrator.

  • Attack complexityDetail

    Exploitation is reliable and condition-free; no race condition, special memory layout, or environmental dependency is required.

Blast Radius

  • Reads stored database content, which in a typical WordPress deployment includes user credentials (hashed passwords), email addresses, session tokens, and plugin configuration data.
  • Executes blind SQL queries that can enumerate table structure and extract records row by row, even though results are not returned inline.
  • Causes partial disruption to the analytics service through resource-intensive injected queries, degrading availability for legitimate users.

How HarborGuard Handles This

Available on HarborGuard: detection for CVE-2026-54818 is active across connected registries and pipelines, flagging any image that ships the Slimstat Analytics plugin at or below version 5.4.11. Because no upstream patch exists yet, HarborGuard monitors the Patchstack and NVD advisory feeds on every ingest cycle and will automatically trigger a patched-image rebuild and, for customers with auto-remediation enabled, a regression-test run and a PR opened against affected workloads the moment a fix is published. While the CVE remains unpatched, recommended compensating controls include applying WordPress network-policy rules to restrict database-layer access, enforcing a web application firewall rule that blocks SQL metacharacter sequences in plugin-related request parameters, and disabling the Slimstat Analytics plugin in environments where analytics collection is non-essential. Customers should review their compliance policy settings in HarborGuard to ensure this HIGH-severity finding is routed to the correct team inbox and is subject to their organization's SLA for remediation tracking.

See how HarborGuard automates this
Affected packages
  • VeronaLabs / Slimstat Analytics
    ≤ 5.4.11
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
References