Live › vulnerability › CVE-2026-117572
The WP Visitor Statistics (Real Time Traffic) WordPress plugin does not sanitize a parameter before using it in a SQL statement. An administrator or other high-privilege user can inject SQL to read or change data in the WordPress database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Sites running the WP Visitor Statistics (Real Time Traffic) WordPress plugin before version 8.8. The flaw needs a high-privilege account such as an administrator, so exposure is lower on sites where few people hold admin rights. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp-content/plugins/ and its version header.8.8; anything earlier is listed as affected.8.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-117572")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.