CVE-2026-117572: WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter
Published Oct 30, 2026
·Updated
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.
Event History
Oct 30, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
Description
Data Sourced
via NVD·06:16 AM
SeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must already have high-privilege access to the WordPress site, such as an administrator account. The issue is remotely reachable but does not require user interaction.
2
Are sites running version 8.8 affected?
The affected versions are those before 8.8. The provided information does not identify any affected configuration details beyond the installed plugin version.
3
What input is involved in the injection?
The vulnerable input is the order parameter, which is used in a SQL statement without sufficient sanitization and escaping.