EUVD-2026-57863
GHSA-rmx4-4cx3-37j4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Subscriber account (PR:L) over the network (AV:N) with no special conditions; S:C reflects DB-wide read access beyond plugin scope; I:N consistent with read-only injection path.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
AnalysisAI
SQL injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions 11.10 and earlier) enables any subscriber-level authenticated user to extract sensitive data from the site's underlying database. The CVSS 3.1 score of 8.5 reflects a network-accessible, low-complexity attack with a changed scope, meaning the injection reaches beyond the plugin's own tables into the shared WordPress database - including user credentials and personally identifiable information. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Technical ContextAI
The affected product is a WordPress analytics plugin developed by Codepress (CPE: cpe:2.3:a:codepress:visitor_traffic_real_time_statistics_pro:*:*:*:*:*:*:*:*), designed to display real-time visitor traffic data within the WordPress admin interface. The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that subscriber-controlled input is concatenated directly into SQL statements without adequate parameterization or escaping before execution against the WordPress MySQL/MariaDB backend. The CVSS scope-change flag (S:C) is significant: it confirms the injection's reach extends across the shared WordPress database connection, which typically grants access to all tables the wp_ database user can read - well beyond the plugin's own data domain.
RemediationAI
Update the Visitor Traffic Real Time Statistics Pro plugin to a version later than 11.10 as the primary remediation; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/visitors-traffic-real-time-statistics-pro/vulnerability/wordpress-visitor-traffic-real-time-statistics-pro-plugin-11-10-sql-injection-vulnerability for the confirmed fixed release and any additional guidance. If an immediate upgrade is not feasible, deactivate the plugin entirely until patching is possible, accepting the trade-off of losing real-time traffic analytics visibility. As an additional compensating control, disabling open user registration (Settings > General > Membership in WordPress) closes the self-service path by which an unauthenticated attacker can obtain a subscriber account, though this does not eliminate risk from already-registered users. The exact patched version number was not independently confirmable from the data provided; verify the latest available release against the WordPress plugin repository before deploying.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenat
Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPre
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refU
Authenticated remote code execution in the Admin Columns WordPress plugin (versions through 7.0.18) allows Contributor-l
Unauthenticated stored/reflected Cross-Site Scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Osamaesh WP Visitor Statistics (Real Time Tr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today