Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116609— WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute

Quick assessment

Affected
osamaesh WP Visitor Statistics (Real Time Traffic)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的"WP Visitor Statistics (Real Time Traffic)"插件在 8.8 版本及之前存在 SQL 注入漏洞。该漏洞源于对 短代码中 属性（及其兄弟属性 、 、 ）的用户输入未进行充分转义，且现有 SQL 查询缺乏足够的预处理。具体而言， 函数原样返回攻击者提供的短代码属性（WordPress 核心未对其进行任何净化），随后仅对 进行了二次净化；而原始值随后被直接拼接进 函数（位于 ）中的双引号 SQL 字符串字面量内，并通过 执行。这使得拥有 Contributor

CVSS 6.5 · Medium EPSS 0.34% · P27

Affected Version Matrix 1

VendorProduct Version RangeStatus
osamaesh WP Visitor Statistics (Real Time Traffic) ≤ 8.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116609

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the user-supplied attribute and lack of sufficient preparation on the existing SQL query: `shortcode_atts()` returns attacker-supplied shortcode attributes verbatim (WP core performs no sanitization), only `$atts['id']` is re-sanitized afterward, and the raw value is then concatenated into a double-quoted SQL string literal inside `fnGetHourlyReportByDateNameTimeZone()` (`includes/wsm_db.php:1449`) and executed via `$wpdb->get_results()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
osamaesh WP Visitor Statistics (Real Time Traffic) 0 ~ 8.8 -

II. Public POCs for CVE-2026-116609

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116609

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116609 (1)

Vendor Pages for CVE-2026-116609 (1)

IV. Related Vulnerabilities

Same product: WP Visitor Statistics (Real Time Traffic)
Same vendor: osamaesh
Same weakness: CWE-89