{"id":"CVE-2026-117572","kind":"vulnerability","aliases":["CVE-2026-117572"],"related":[],"title":"WP Visitor Statistics WordPress plugin: SQL injection by administrators","description":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.","summary":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin does not sanitize a parameter before using it in a SQL statement. An administrator or other high-privilege user can inject SQL to read or change data in the WordPress database.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-visitor-statistics"],"not_affected_if":["plugin-8.8-or-later","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the plugin folder `wp-content/plugins/` and its version header.\n- Compare the installed version against `8.8`; anything earlier is listed as affected.","fix":"- WP Visitor Statistics (Real Time Traffic) plugin: move to `8.8` or later.","status":"open","published_at":"2026-10-30T06:16:46+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","triaged_at":"2026-10-30T06:30:01+00:00","updated_at":"2026-10-30T06:30:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T06:30:01Z","model":"claude-haiku-5-5","output":{"fix":"- WP Visitor Statistics (Real Time Traffic) plugin: move to `8.8` or later.","reach":"network","title":"WP Visitor Statistics WordPress plugin: SQL injection by administrators","impact":"high","summary":"The WP Visitor Statistics (Real Time Traffic) WordPress plugin does not sanitize a parameter before using it in a SQL statement. An administrator or other high-privilege user can inject SQL to read or change data in the WordPress database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-visitor-statistics","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"database contents read or changed through injected SQL","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the plugin folder `wp-content/plugins/` and its version header.\n- Compare the installed version against `8.8`; anything earlier is listed as affected.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-8.8-or-later"],"who_is_affected":"Sites running the WP Visitor Statistics (Real Time Traffic) WordPress plugin before version 8.8. The flaw needs a high-privilege account such as an administrator, so exposure is lower on sites where few people hold admin rights. Sites that do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4112,"output_tokens":551,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117572':12A,15A '-2026':11A,14A '8.8':76C 'administr':9A,47B,98C 'allow':91C 'attack':103C 'chang':60B 'cve':10A,13A 'data':61B 'databas':65B 'escap':81C 'high':51B,93C 'high-privileg':50B,92C 'host':19B 'inject':7A,55B,102C 'packag':16B 'paramet':38B,83C 'perform':100C 'plugin':5A,33B,74C 'privileg':52B,94C 'read':58B 'real':29B,70C 'sanit':36B,79C 'self':18B 'self-host':17B 'sql':6A,44B,56B,89C,101C 'statement':45B,90C 'statist':3A,24B,28B,69C 'time':30B,71C 'traffic':31B,72C 'use':40B,85C 'user':53B,95C 'visitor':2A,23B,27B,68C 'wordpress':4A,20B,32B,64B,73C 'wp':1A,22B,26B,67C 'wp-visitor-statist':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Visitor Statistics (Real Time Traffic) WordPress plugin before version 8.8. The flaw needs a high-privilege account such as an administrator, so exposure is lower on sites where few people hold admin rights. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117572","severity":null,"published_at":"2026-10-30T06:16:46+00:00","modified_at":"2026-10-30T06:16:46+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","fetched_at":"2026-10-30T06:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}