WP Visitor Statistics EUVD-2026-111733

Exploitation requires an authenticated account with Contributor-level privileges or higher on a WordPress site running WP Visitor Statistics (Real Time Traffic) version 8.8 or earlier, and the ability to place the [wsm_showTrafficStatsList] shortcode (via post/page content the attacker can author) with attacker-controlled 'from', 'to', 'first', or 'second' attribute values. The specific trigger is that shortcode_atts() passes these attributes through unsanitized (only $atts['id'] is re-sanitized) and the raw value is concatenated into a double-quoted SQL literal in fnGetHourlyReportByDateNameTimeZone(). Limiting factors: the Contributor+ authentication requirement (PR:L) excludes fully anonymous attackers and narrows realistic exploitation to sites allowing untrusted authoring or where a low-privilege account is already compromised; impact is confined to database read (confidentiality), with no stated integrity or availability effect.

This is a moderate-priority, authenticated SQL injection (CWE-89) with a coherent set of signals rather than conflicting ones. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network-reachable, low-complexity exploitation but requires privileges (PR:L), which the description pins down precisely as Contributor-level access and above. The confidentiality-only impact (C:H, I:N, A:N) matches the description's claim of data extraction via appended queries. Decision signals are consistent with a non-emergency posture: the vuln.today Decision label is 'this_month' (not act_now/emergency), the CVE is NOT listed in CISA KEV, no EPSS exploitation-probability score was supplied, and no working exploit code is referenced - only the Wordfence advisory, the vulnerable source lines on plugins.trac, and the fix changeset. The main limiting factor is the authentication requirement: an attacker needs a valid Contributor (or higher) account on the target site, which meaningfully narrows the realistic attacker population to sites with open/multi-author registration or already-compromised low-privilege accounts. Net assessment: a genuine confidentiality risk worth patching on a normal cycle, but not a drop-everything emergency given the authenticated precondition, absence of KEV, and no confirmed public exploit. Missing data to note explicitly: no EPSS score provided and no independently confirmed fixed version number (the fix is evidenced only by changeset 3768203).

An attacker holding a Contributor-level (or higher) account on a WordPress site running WP Visitor Statistics ≤8.8 authors a post or page containing the [wsm_showTrafficStatsList] shortcode with a malicious 'from' (or 'to'/'first'/'second') attribute value. Because WordPress core's shortcode_atts() returns the attribute verbatim and the plugin concatenates it directly into a double-quoted SQL string in fnGetHourlyReportByDateNameTimeZone() (includes/wsm_db.php:1449) executed via $wpdb->get_results(), the attacker appends additional SQL to read sensitive data such as credentials or password hashes from the database. No public exploit identified at time of analysis; the trigger path is fully described in the referenced plugin source.