CVE-2023-52204 is a high severity (8.5 CVSS) SQL injection flaw in the Randomize plugin for WordPress, in versions through 1.4.3. Patchstack says it can be reached by an account at the Contributor role. Neither the record nor the Patchstack page we read names a patched version, so check the plugin page before relying on any update.
What's affected
The NVD record covers Randomize from Javik, all versions through 1.4.3. The weakness is CWE-89 (SQL Injection), described as improper neutralization of special elements used in an SQL command.
The CVSS vector in the record marks privileges required as low, and Patchstack lists the Contributor role. On sites that let outsiders register or submit content, that role can be easy to obtain.
No patched release is named. Treat every version of the plugin as affected until the vendor or Patchstack says otherwise.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get randomize --field=version
The slug randomize comes from the Patchstack advisory address, so confirm it matches the folder under wp-content/plugins on your site. A version of 1.4.3 or lower is in the affected range. The Plugins screen in the dashboard shows the same version number.
Then look at who holds the Contributor role or higher:
wp user list --role=contributor --fields=ID,user_login,user_registered
An unexpected account, or one created recently, deserves a closer look before you touch anything else.
What to do now
- Back up the site and its database.
- If you can, deactivate and delete Randomize. If you need it, limit who holds the Contributor role until a fix appears, and watch the plugin page for a release.
- Review accounts with the Contributor role or above and remove any you do not recognise.
- Rotate database credentials and administrator passwords if you see signs of misuse.
- Enable query and error logging at your host if you can, and look for unexpected database errors.
Why it matters
SQL injection happens when input reaches a database query without being separated from the query's structure. The usual cure is parameterized queries, which keep data and commands apart. The advisory does not describe the vulnerable parameter and we will not guess at it.
The vector in the record scores confidentiality impact as high, so the concern is reading data from the WordPress database, which can include user records and stored settings. The scope is marked changed, meaning the effect can reach beyond the plugin itself. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
Roles matter here. A Contributor or Editor account is routine on a multi-author blog, and a stolen or weak password for such an account turns a role-limited flaw into a full database read. Strong passwords, two-factor sign-in and a short list of accounts reduce that exposure. For a wider view of your own code, the free in-browser dependency scan and the Gold directory show which packages carry known CVEs, and reachability analysis helps you decide which findings to fix first. WordPress plugins installed from the admin screen do not sit in a manifest, so start with the wp-cli inventory above for those.
Quick check
Is this exploitable by anyone on the internet?
Not according to Patchstack. It lists the Contributor role as required, so the attacker needs an account at that level first. That is a lower bar than administrator and still worth closing.
What if no fix exists for my version?
Remove the plugin or replace it with a maintained alternative. If you must keep it, restrict who holds elevated roles and watch for a vendor release.
Sources
Last reviewed: 19 October 2026.
