Description

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-27T10:16:35.543Z",
  "pubdate": "2026-08-27T10:16:35.543Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability exists in the Visitor Traffic Real Time Statistics Pro plugin for WordPress, affecting all versions up to and including 11.17.\nThe vulnerability allows remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database, leading to unauthorized data exposure, modification, or potential administrative account compromise.\nThis flaw stems from insufficient sanitization and parameterization of user-supplied input before passing it to database queries.\nSuccessful exploitation requires no authentication, making the plugin highly susceptible to automated scanning and exploitation attempts.\nThe risk is categorized as critical, as it bypasses standard access control mechanisms and facilitates full backend database access, potentially leading to a complete compromise of the WordPress installation.",
  "technicalDetails": "The vulnerability is rooted in the improper handling of user-controllable input within the Visitor Traffic Real Time Statistics Pro plugin. Specifically, input provided via specific parameters is concatenated directly into SQL query strings without adequate sanitization or the use of prepared statements.\nThe affected component fails to validate the structure and content of external requests, allowing an attacker to inject malicious SQL syntax into legitimate database operations. By appending crafted payloads to these parameters, an attacker can manipulate the query logic, effectively escaping the intended scope of the database interaction.\nThe attack flow begins when an attacker sends a crafted HTTP request containing malicious SQL fragments to the vulnerable endpoint. Because the plugin does not enforce authentication or privilege checks, these requests are processed by the server-side code without verification. The backend database interprets the injected command as part of the authorized query, executing it within the context of the application's database user.\nExploitation typically involves techniques such as UNION-based SQL injection, which allows the attacker to retrieve data from other tables within the database. Attackers may also leverage time-based or boolean-based blind injection techniques to infer sensitive information, such as administrative hashes, configuration details, or personal user data, by observing the server's response patterns.\nThe scope of impact is broad, extending to the entire WordPress database. Post-exploitation, an attacker could extract sensitive information, modify existing records to create new administrative accounts, or execute administrative tasks that compromise the integrity and availability of the web application.\nThis vulnerability is present in versions 11.17 and below. The lack of parameterized queries or robust input validation functions ensures that any input reaching the affected database interaction point remains susceptible to manipulation, regardless of the web application firewall (WAF) configuration, if standard SQL injection patterns are sufficiently obfuscated.\nThe exposure is network-wide, as the vulnerable entry point is accessible via standard HTTP/HTTPS protocols without requiring previous session state or authenticated cookies."
}