WP Visitor Statistics EUVD-2026-113727

Exploitation requires an authenticated WordPress administrator (or equivalent high-privilege) account, because the vulnerable parameter is only reachable and injectable by such users - this is the primary limiting factor (CVSS PR:H). The concrete trigger is a specific plugin parameter that WP Visitor Statistics (Real Time Traffic) passes into a SQL statement without sanitizing or escaping it; the exact parameter name and request path are not described in the available sources. No special non-default configuration is indicated. The administrator-privilege requirement substantially narrows realistic risk: an external unauthenticated attacker cannot reach this directly, and an actor already holding admin rights has extensive legitimate database access anyway.

This is a genuinely low-priority finding despite the SQL-injection class, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N, base 4.1) already encodes the core limiter: PR:H means exploitation requires an authenticated high-privilege account (administrator), per the description. EPSS reinforces low urgency at 0.16% (5th percentile), and the CISA SSVC framing agrees - Exploitation: none, Automatable: no, Technical Impact: partial. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit is identified in the input beyond the WPScan advisory page. The one internal tension worth noting is that the vendor vector sets C:L and I:N/A:N for a SQL-injection flaw; a raw SQLi can often read arbitrary database contents (which would argue C:H), but because the only actor who can trigger it is already a WordPress administrator with broad database access, the marginal confidentiality gain is reasonably rated Low. Net: a real but low-severity, admin-only issue appropriate for routine patching (vuln.today 'this_month'), not an emergency.

A user who already holds WordPress administrator rights (or an attacker who has compromised such an account) submits a crafted value in the vulnerable plugin parameter, which is concatenated into a SQL statement without sanitization or escaping. The injected SQL runs against the WordPress database, allowing the admin-level actor to read data beyond what the plugin's intended query exposes. No public working exploit code is identified in the provided sources; only a WPScan advisory reference exists.