Live › vulnerability › CVE-2026-116609
Go to dashboardThe WP Visitor Statistics (Real Time Traffic) WordPress plugin up to and including 8.8 passes the 'from', 'to', 'first' and 'second' attributes of the [wsm_showTrafficStatsList] shortcode unescaped into a SQL query. An attacker with Contributor access can append SQL to that query and read sensitive data from the database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running the WP Visitor Statistics (Real Time Traffic) plugin at version 8.8 or earlier are exposed. The risk requires a logged-in user with Contributor role or above who can add shortcodes to content, so sites where only administrators or editors write content, or where the plugin is not installed, can skip it.
No product ranges from the sources yet.
wp plugin get wp-visitor-statistics --field=version (the slug is unknown from the sources, so confirm it).[wsm_showTrafficStatsList shortcode.8.8; the patched version number is unknown from the sources.[wsm_showTrafficStatsList] shortcode from content.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the user-supplied attribute and lack of sufficient preparation on the existing SQL query: shortcode_atts() returns attacker-supplied shortcode attributes verbatim (WP core performs no sanitization), only $atts['id'] is re-sanitized afterward, and the raw value is then concatenated into a double-quoted SQL string literal inside fnGetHourlyReportByDateNameTimeZone() (includes/wsm_db.php:1449) and executed via $wpdb->get_results(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
This page as .md · .json · in your agent: get_signal("CVE-2026-116609")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.