CVE-2023-54333
Published: 13 January 2026
Summary
CVE-2023-54333 is a high-severity SQL Injection (CWE-89) vulnerability in Supsystic (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2023-54333 is a critical SQL injection vulnerability (CWE-89) in Social-Share-Buttons version 2.2.3, a WordPress plugin. The issue affects the project_id parameter, allowing attackers to manipulate database queries via crafted POST requests with malicious SQL payloads. Published on 2026-01-13, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), highlighting high confidentiality impact with low integrity impact and no availability disruption.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. By sending specially crafted POST requests, they can inject SQL payloads to retrieve and potentially steal entire database contents from affected WordPress installations running the vulnerable plugin version.
Advisories and related resources, including those from VulnCheck and the plugin developer at supsystic.com, detail the vulnerability. Proof-of-concept exploits are publicly available on Exploit-DB (exploit ID 51116) and GitHub repositories under nu11secur1ty/CVE-nu11secur1ty, providing technical reproduction steps for security practitioners to test and verify impacts.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2590
Vulnerability details
Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted POST requests with malicious SQL payloads to retrieve and potentially steal entire database…
more
contents.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated SQLi in public-facing WordPress plugin enables remote exploitation of web application for DB data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of flaws such as the SQL injection in CVE-2023-54333 by patching the vulnerable Social-Share-Buttons plugin.
SI-10 enforces validation of untrusted inputs like the project_id parameter to reject malicious SQL payloads and prevent database manipulation.
RA-5 implements vulnerability scanning to identify SQL injection flaws like CVE-2023-54333 in WordPress plugins before exploitation.