WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated Second-Order SQL Injection via fullRef Parameter
- ID
- WPSEC-2026-0169
- Plugin
- WP Visitor Statistics (Real Time Traffic) (wp-stats-manager)
- Affected
- from 5.6 before 8.7.1
- Remediation
- Update to 8.7.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP Visitor Statistics (Real Time Traffic) on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-96267, on 2026-10-02.
Description
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to second-order SQL Injection via the 'fullRef' parameter of the public visitor-tracking request in versions 5.6 up to, and including, 8.7. This is due to the search keyword derived from that parameter being URL- and HTML-entity-decoded before it is stored, and the stored keyword later being concatenated without escaping into the LIKE clause of the Traffic Sources "Referring Sites" report query. This makes it possible for unauthenticated attackers to plant a crafted value that, when an administrator views the report, is appended to the existing query and can be used to extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-0169/
- https://plugins.svn.wordpress.org/wp-stats-manager/tags/8.7.1/
- https://wordpress.org/plugins/wp-stats-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS