Executive brief
Slimstat Analytics is a popular WordPress plugin used to track and analyze website visitor data. A security flaw in versions prior to 5.4.0 allows unauthenticated attackers to submit malicious data that the plugin incorrectly processes. If successfully exploited, this could lead to unauthorized access to the website's administrative panel, service disruptions, or the execution of malicious commands.
Technical details
A deserialization of untrusted data vulnerability (CWE-502) exists in the VeronaLabs Slimstat Analytics plugin for WordPress in versions prior to 5.4.0. The flaw allows an unauthenticated remote attacker to submit specially crafted serialized data to the application. Because the plugin does not properly validate this input before passing it to a deserialization function, an attacker could potentially achieve remote code execution (RCE), bypass security logic, or cause a denial of service. Exploitation requires the presence of suitable 'POP chains' within the environment. The issue is resolved in version 5.4.0.
Affected products
- VeronaLabs Slimstat Analytics < 5.4.0
Timeline
- 2025-11-02: other: Reported by researcher mcdruid
- 2026-06-01: patched: Version 5.4.0 released
- 2026-06-17: disclosed: CVE published to NVD