CVE-2026-116609: WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute

Q: Who can exploit this issue?

An authenticated WordPress user with Contributor-level access or higher can exploit it. The attacker must be able to submit a [wsm_showTrafficStatsList] shortcode with crafted attributes.

Q: Which inputs are affected?

The affected shortcode attributes are 'from' and the related 'to', 'first', and 'second' attributes. Their values can reach a database query without sufficient escaping or prepared-statement handling.

Q: What is the likely impact of successful exploitation?

An attacker can append SQL to an existing query and extract sensitive information from the WordPress database. The supplied severity vector indicates high confidentiality impact, with no stated integrity or availability impact.

Q: Are installations using the default WordPress shortcode handling protected?

No. The issue exists because shortcode_atts() returns supplied shortcode attributes verbatim, and only the 'id' attribute is subsequently re-sanitized. The affected attributes are concatenated into a double-quoted SQL string before execution.

Published Oct 28, 2026

Updated

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsmshowTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the user-supplied attribute and lack of sufficient preparation on the existing SQL query: shortcodeatts() returns attacker-supplied shortcode attributes verbatim (WP core performs no sanitization), only $atts['id'] is re-sanitized afterward, and the raw value is then concatenated into a double-quoted SQL string literal inside fnGetHourlyReportByDateNameTimeZone() (includes/wsmdb.php:1449) and executed via $wpdb->getresults(). This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected Software

1 affected component

WordPress WP Visitor Statistics (Real Time Traffic)<=8.8

Event History

Oct 28, 2026

CVE Published

via MITRE·06:45 AM

Data Sourced

via MITRE·06:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with Contributor-level access or higher can exploit it. The attacker must be able to submit a [wsm_showTrafficStatsList] shortcode with crafted attributes.

Which inputs are affected?

The affected shortcode attributes are 'from' and the related 'to', 'first', and 'second' attributes. Their values can reach a database query without sufficient escaping or prepared-statement handling.

What is the likely impact of successful exploitation?

An attacker can append SQL to an existing query and extract sensitive information from the WordPress database. The supplied severity vector indicates high confidentiality impact, with no stated integrity or availability impact.

Are installations using the default WordPress shortcode handling protected?

No. The issue exists because shortcode_atts() returns supplied shortcode attributes verbatim, and only the 'id' attribute is subsequently re-sanitized. The affected attributes are concatenated into a double-quoted SQL string before execution.

CVE-2026-116609: WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which inputs are affected?

What is the likely impact of successful exploitation?

Are installations using the default WordPress shortcode handling protected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which inputs are affected?

What is the likely impact of successful exploitation?

Are installations using the default WordPress shortcode handling protected?