SQL Injection Vulnerability in WP Visitor Statistics Plugin for WordPress

CVE-2026-116609

What is CVE-2026-116609?

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is susceptible to SQL Injection, which can be exploited by authenticated attackers with Contributor-level access or higher. This vulnerability arises from insufficient escaping of user-supplied shortcode attributes in the [wsm_showTrafficStatsList] shortcode. When attributes like 'from', 'to', 'first', or 'second' are processed, they are returned verbatim due to the absence of proper sanitization. Consequently, malicious actors can inject additional SQL queries into existing ones, potentially allowing them to extract sensitive information from the database. It is crucial for users of this plugin to update to the latest version to mitigate this risk.

References