CVE-2023-5041 is a high severity (CVSS 8.8 in NVD) blind SQL injection in the Track The Click WordPress plugin before version 0.3.12. A logged in user with the author role or higher can reach it through the stats REST endpoint. Update to 0.3.12 or later.
What's affected
The NVD record says the Track The Click plugin, before 0.3.12, does not properly sanitize query parameters to the stats REST endpoint before using them in a database query. A logged in user with an author role or higher can perform time based blind SQL injection against the database.
WPScan lists the fix as 0.3.12 and adds a detail that matters: version 0.3.11 made the API endpoint reachable only by administrators and fixed some of the injection points, but not all of them. So 0.3.11 is not a safe stopping point. Update to 0.3.12 or later.
Severity differs by source. NVD scores the issue 8.8, while WPScan gives 7.6. Both are high. The author role requirement is the main limit, and it is a real one on sites where only trusted staff write posts.
How to check if you're exposed
List plugin versions with WP-CLI.
wp plugin list --format=table
wp plugin get track-the-click --fields=name,status,version
Then review the accounts that hold the author role or higher. On sites with guest writers, contributor programs or open registration with auto promotion, this group can be much larger than you expect.
Look at database slow query logs and web logs for repeated requests to the plugin REST route with long response times, which is the pattern of time based probing.
What to do now
- Update Track The Click to 0.3.12 or later on every site, and do not stop at 0.3.11.
- Reduce the number of author level accounts and review how people get that role.
- Require strong passwords and multi factor authentication for accounts that can publish.
- Review the database for unexpected changes to users and options.
- Consider replacing the plugin with a tracking approach you already maintain.
Why it matters
The weakness is CWE-89, improper neutralization of special elements in an SQL command. Values from the request are placed in a query as text instead of as parameters, so the database can be made to answer questions through timing differences, even when no data comes back directly.
Blind injection is slow, but slow is not safe. Tools automate it and a patient attacker only needs a login. The WPScan note about the partial fix in 0.3.11 is a good reminder to read the full fix history, because a first patch can leave siblings behind. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is 0.3.11 enough?
No. WPScan says 0.3.11 restricted the endpoint to administrators and fixed some of the injections, but not all. Use 0.3.12 or later.
Sources
Last reviewed: 19 October 2026.
