Source: wp.org support thread

Validation Result: Confirmed Bug

Verdict: VALID_BUG | Confidence: HIGH | Severity: Critical

Summary

The v5.4 visit_id generation mechanism queries information_schema.TABLES on every pageview and includes an unbounded collision-detection loop, causing database saturation under moderate-to-high traffic.

Root Cause

Fault Location: src/Tracker/Session.php:101-122, src/Tracker/Processor.php:532-553, src/Tracker/Tracker.php:102-124
Mechanism: AUTO_INCREMENT lookup via information_schema.TABLES (slow metadata query) + unbounded do...while loop for collision detection generates O(n) DB queries per request.

Causal Chain:

• Visitor pageview → Tracker::slimtrack() (priority 5, blocks rendering)
  → Session::ensureVisitId() → queries information_schema.TABLES (metadata lock)
  → checks for ID collision → loops incrementing + querying until free ID found
  → under concurrent traffic: many requests loop simultaneously → DB connection exhaustion → 503

5 Whys:

1. 503 errors → DB connection pool exhausted
2. Pool exhausted → each request holds connection during sequential queries
3. Sequential queries → visit_id collision loop fires multiple queries per request
4. Loop fires often → AUTO_INCREMENT returns stale values under concurrent inserts (ROOT CAUSE)

Reproduction Steps

Preconditions: WP Slimstat 5.4+, server-side tracking (default), 10k+ rows in slim_stats

1. Activate WP Slimstat with default settings
2. Generate 20+ concurrent pageviews (load test or real traffic)
3. Observe degraded response times and eventual 503 errors
4. Confirm via SHOW PROCESSLIST: multiple information_schema and slim_stats queries queued

Expected: Tracking doesn't impact page load
Actual: 3-5+ DB queries per pageview minimum; unbounded loop under collisions

Code References

Security Note

If implementing a fix based on this analysis:

• Verify the fix doesn't introduce new vulnerabilities
• Run security linting (SAST) on changed code
• Check for OWASP Top 10 in any new code paths

Validated via qa-issue-validate skill (jaan.to plugin)