{"id":"CVE-2026-116609","kind":"vulnerability","aliases":["CVE-2026-116609"],"related":[],"title":"WP Visitor Statistics plugin: shortcode attributes enable SQL injection for contributors","description":"The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the user-supplied attribute and lack of sufficient preparation on the existing SQL query: `shortcode_atts()` returns attacker-supplied shortcode attributes verbatim (WP core performs no sanitization), only `$atts['id']` is re-sanitized afterward, and the raw value is then concatenated into a double-quoted SQL string literal inside `fnGetHourlyReportByDateNameTimeZone()` (`includes/wsm_db.php:1449`) and executed via `$wpdb->get_results()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","summary":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin up to and including 8.8 passes the 'from', 'to', 'first' and 'second' attributes of the [wsm_showTrafficStatsList] shortcode unescaped into a SQL query. An attacker with Contributor access can append SQL to that query and read sensitive data from the database.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","package","php","wordpress","wordpress-plugins"],"not_affected_if":["auth-required","no-contributor-accounts","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or with `wp plugin get wp-visitor-statistics --field=version` (the slug is unknown from the sources, so confirm it).\n- Search posts and templates for the `[wsm_showTrafficStatsList` shortcode.","fix":"- Update the WP Visitor Statistics (Real Time Traffic) plugin to a version later than `8.8`; the patched version number is unknown from the sources.\n- If no fixed version is available, deactivate the plugin or remove the `[wsm_showTrafficStatsList]` shortcode from content.","status":"open","published_at":"2026-10-28T07:16:47+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","triaged_at":"2026-10-28T07:32:54+00:00","updated_at":"2026-10-28T07:32:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T07:32:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WP Visitor Statistics (Real Time Traffic) plugin to a version later than `8.8`; the patched version number is unknown from the sources.\n- If no fixed version is available, deactivate the plugin or remove the `[wsm_showTrafficStatsList]` shortcode from content.","reach":"internet","title":"WP Visitor Statistics plugin: shortcode attributes enable SQL injection for contributors","impact":"medium","summary":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin up to and including 8.8 passes the 'from', 'to', 'first' and 'second' attributes of the [wsm_showTrafficStatsList] shortcode unescaped into a SQL query. An attacker with Contributor access can append SQL to that query and read sensitive data from the database.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","php","mysql"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads sensitive database contents via injected SQL","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or with `wp plugin get wp-visitor-statistics --field=version` (the slug is unknown from the sources, so confirm it).\n- Search posts and templates for the `[wsm_showTrafficStatsList` shortcode.","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-contributor-accounts","auth-required"],"who_is_affected":"Sites running the WP Visitor Statistics (Real Time Traffic) plugin at version 8.8 or earlier are exposed. The risk requires a logged-in user with Contributor role or above who can add shortcodes to content, so sites where only administrators or editors write content, or where the plugin is not installed, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":3579,"output_tokens":675,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116609':14A,17A '-2026':13A,16A '1449':174C '8.8':38B,111C 'access':61B,192C 'addit':197C 'afterward':155C 'alreadi':201C 'append':63B,196C 'att':135C,149C 'attack':58B,138C,187C 'attacker-suppli':137C 'attribut':6A,46B,99C,123C,141C 'authent':186C 'concaten':162C 'contributor':11A,60B,190C 'contributor-level':189C 'core':144C 'cve':12A,15A 'data':71B 'databas':74B,214C 'doubl':166C 'double-quot':165C 'due':114C 'enabl':7A 'escap':117C 'execut':176C 'exist':131C,202C 'extract':209C 'first':43B,96C 'fngethourlyreportbydatenametimezon':172C 'get':179C 'id':150C 'includ':37B,110C 'includes/wsm_db.php':173C 'inform':211C 'inject':9A,89C 'insid':171C 'insuffici':116C 'lack':125C 'level':191C 'liter':170C 'make':182C 'mysql':18B 'packag':19B 'pass':39B 'perform':145C 'php':20B 'plugin':4A,24B,33B,82C 'possibl':184C 'prepar':128C 'queri':56B,67B,133C,199C,203C 'quot':167C 'raw':158C 're':153C 're-sanit':152C 'read':69B 'real':29B,79C 'result':180C 'return':136C 'sanit':147C,154C 'second':45B,97C 'sensit':70B,210C 'shortcod':5A,51B,98C,104C,134C,140C 'showtrafficstatslist':50B,103C 'sibl':94C 'sql':8A,55B,64B,88C,132C,168C,198C 'statist':3A,28B,78C 'string':169C 'suffici':127C 'suppli':122C,139C 'time':30B,80C 'traffic':31B,81C 'unescap':52B 'use':207C 'user':121C 'user-suppli':120C 'valu':159C 'verbatim':142C 'version':106C 'via':90C,177C 'visitor':2A,27B,77C 'vulner':86C 'wordpress':21B,23B,32B,84C 'wordpress-plugin':22B 'wp':1A,26B,76C,143C 'wpdb':178C 'wsm':49B,102C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Visitor Statistics (Real Time Traffic) plugin at version 8.8 or earlier are exposed. The risk requires a logged-in user with Contributor role or above who can add shortcodes to content, so sites where only administrators or editors write content, or where the plugin is not installed, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116609","severity":null,"published_at":"2026-10-28T07:16:47+00:00","modified_at":"2026-10-28T07:16:47+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","fetched_at":"2026-10-28T07:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}