---
id: "CVE-2026-116609"
kind: "vulnerability"
aliases: ["CVE-2026-116609"]
title: "WP Visitor Statistics plugin: shortcode attributes enable SQL injection for contributors"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mysql", "package", "php", "wordpress", "wordpress-plugins"]
not_affected_if: ["auth-required", "no-contributor-accounts", "plugin-not-installed"]
published_at: "2026-10-28T07:16:47+00:00"
first_seen_at: "2026-10-28T07:31:38+00:00"
updated_at: "2026-10-28T07:32:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116609", "first_seen_at": "2026-10-28T07:31:38+00:00"}]
---

# WP Visitor Statistics plugin: shortcode attributes enable SQL injection for contributors

The WP Visitor Statistics (Real Time Traffic) WordPress plugin up to and including 8.8 passes the 'from', 'to', 'first' and 'second' attributes of the [wsm_showTrafficStatsList] shortcode unescaped into a SQL query. An attacker with Contributor access can append SQL to that query and read sensitive data from the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list or with `wp plugin get wp-visitor-statistics --field=version` (the slug is unknown from the sources, so confirm it).
- Search posts and templates for the `[wsm_showTrafficStatsList` shortcode.

## Fix

- Update the WP Visitor Statistics (Real Time Traffic) plugin to a version later than `8.8`; the patched version number is unknown from the sources.
- If no fixed version is available, deactivate the plugin or remove the `[wsm_showTrafficStatsList]` shortcode from content.

## Timeline

- 2026-10-28T07:31:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116609

## From the sources

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the user-supplied attribute and lack of sufficient preparation on the existing SQL query: `shortcode_atts()` returns attacker-supplied shortcode attributes verbatim (WP core performs no sanitization), only `$atts['id']` is re-sanitized afterward, and the raw value is then concatenated into a double-quoted SQL string literal inside `fnGetHourlyReportByDateNameTimeZone()` (`includes/wsm_db.php:1449`) and executed via `$wpdb->get_results()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_