CVE-2025-64293

The WordPress 0 Day Analytics plugin, versions up to and including 4.0.0, contains an improper neutralization of special elements used in an SQL command, leading to a SQL injection vulnerability [1]. This flaw arises from insufficient input validation when handling user-supplied data before constructing database queries.

Attackers can exploit this vulnerability remotely, likely without requiring authentication, by sending specially crafted requests to the plugin's endpoints [1]. The vulnerability is actively used in mass-exploit campaigns, targeting thousands of websites regardless of their size or popularity [1].

Successful exploitation allows an attacker to directly interact with the underlying database, enabling them to read, modify, or delete sensitive information such as user credentials, personal data, and other stored content [1]. This could lead to complete site compromise and data breaches.

The vulnerability has been addressed in version 4.1.0 of the plugin. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins to ensure protection [1].