CVE-2026-117572
WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.
| Vendor | unknown |
| Product | wp visitor statistics (real time traffic) |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp visitor statistics (real time traffic)
Be the first to know when new unknown vulnerabilities affecting unknown wp visitor statistics (real time traffic) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Visitor Statistics (Real Time Traffic)
0 < 8.8
References
Credits
Enrico Marcolini Claudio Marchesini Dottor Marc WPScan