WP Visitor Statistics EUVD-2026-91960

Exploitation requires the WP Visitor Statistics (Real Time Traffic) plugin version ≤8.7 installed and its visitor-tracking active, so that requests to the wmcTrack endpoint are logged into the wp_logVisit table with the raw 'fullRef' referrer value. The planting step needs no authentication or special configuration (reachable by any remote unauthenticated client), but the decisive LIMITING factor is the second-order trigger: the injected SQL does not execute until a logged-in administrator views the Traffic Sources dashboard, meaning exploitation depends on privileged victim activity and will not fire on a dormant or unmonitored admin panel.

This is a genuine but conditional risk rather than an emergency. The injection vector is attractive - CVSS AV:N/AC:L/PR:N/UI:N describes an unauthenticated, network-reachable, low-complexity SQL injection (CWE-89) with high confidentiality impact (C:H) and no integrity or availability impact, consistent with a data-extraction flaw. However, the description reveals a critical nuance the CVSS vector understates: this is a SECOND-ORDER injection. The attacker's crafted 'fullRef' referrer is merely STORED unescaped; the payload only executes when an administrator later opens the Traffic Sources dashboard. That means real-world exploitation depends on a privileged victim action, which the UI:N metric does not capture - I would argue UI:R/UI:P is more honest (see assessed vectors). No exploitation-probability enrichment was provided: there is no EPSS score, no CISA KEV listing, and no SSVC decision data in the input, so I cannot quantify likelihood or automatability. There is no public exploit identified at time of analysis. Net: credible, high-impact-to-confidentiality SQLi in a WordPress plugin, worth prompt patching, but the stored/delayed trigger and absence of any KEV/EPSS/POC signal argue against treating it as actively-exploited-grade urgency.

An unauthenticated attacker sends an HTTP request to the plugin's wmcTrack tracking endpoint with a malicious SQL payload embedded in the referrer (fullRef) value, which the plugin persists verbatim into the wp_logVisit table. The next time a site administrator opens the Traffic Sources dashboard, the stored payload is concatenated into an unprepared query and executes, letting the attacker exfiltrate database contents such as user records and password hashes. No public exploit code was identified at time of analysis, and successful exploitation hinges on an admin subsequently viewing the affected dashboard.