Visitor Traffic Real Time Statistics EUVD-2026-91920

No authentication, nonce, or capability is required: the wp_ajax_nopriv_ahcfree_track_visitor endpoint accepts a forged X-Real-IP HTTP header from any unauthenticated request and persists it, so any internet-reachable site running Visitor Traffic Real Time Statistics ≤8.16 is reachable by default. The specific prerequisite is that the plugin's visitor-tracking functionality be active (which is the plugin's core purpose) and that the attacker can set an arbitrary X-Real-IP header - trivial via a direct HTTP request rather than through a trusted reverse proxy. The principal LIMITING factor is deferred execution: the injected payload only fires when a victim (typically a logged-in administrator) subsequently loads the statistics page that renders the stored value, so impact depends on that view occurring and on the client-side DOM handling of the entity-encoded stored data.

This is a genuine prioritization concern driven by access, not by raw impact. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) shows a fully remote, low-complexity, unauthenticated attack path with a scope change - consistent with the description's explicit claim that the wp_ajax_nopriv_ahcfree_track_visitor endpoint requires no authentication, no nonce, and no capability. The CWE-79 classification and the dedicated vendor code references (Wordfence threat-intel entry plus specific plugins.trac source lines and a patch changeset) corroborate the root cause. However, several exploitation signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no POC flag - so this is 'no public exploit identified at time of analysis,' and real-world exploitation probability cannot be quantified from the data given. Note a modeling tension to verify: the description calls this 'Stored DOM-Based XSS' and states the payload is stored 'entity-encoded ... verbatim,' which suggests execution depends on client-side DOM re-parsing of the encoded value rather than raw reflection - the actual firing depends on how the dashboard JS (ahcfree_js_scripts.js) handles the stored value. Impact is also bounded: C:L/I:L/A:N reflects XSS in a browser session rather than direct server compromise. Net: easy to reach and unauthenticated (real priority for WordPress operators), but impact is session-level and active exploitation is unconfirmed.

An unauthenticated attacker sends a single HTTP request to the plugin's nopriv visitor-tracking AJAX endpoint with a forged X-Real-IP header containing a crafted payload, which is stored in the site database. When an administrator or other user later loads the real-time statistics dashboard that renders the stored IP value client-side, the script executes in their authenticated browser context. No public exploit code is identified in the provided data, but the attack needs no authentication and minimal complexity.