CVE-2026-96267: WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an unauthenticated attacker submits a crafted referrer URL to the wmcTrack tracking endpoint, which persists the raw unescaped value into the wplogVisit table, and the injection is triggered when an administrator next views the Traffic Sources dashboard.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any site running WP Visitor Statistics (Real Time Traffic) version 8.7 or earlier is exposed. Exploitation does not require authentication, but the stored payload is triggered when an administrator views the Traffic Sources dashboard.
What does an attacker need to do to exploit this issue?
An attacker submits a crafted referrer URL through the wmcTrack tracking endpoint using the fullRef parameter. The value is stored in the wp_logVisit table and is later used in a SQL query when an administrator opens the Traffic Sources dashboard.
Is user interaction required for the SQL injection to execute?
The attacker does not need a user account or direct administrator interaction at submission time. However, an administrator must subsequently view the Traffic Sources dashboard for the second-order SQL injection to be triggered.
What can be done if patching is not immediately possible?
Restrict or avoid administrator access to the Traffic Sources dashboard until the affected plugin is updated or otherwise remediated. This reduces the opportunity for stored fullRef values to be processed by the vulnerable query.
How can I check for potentially malicious stored input?
Review entries in the wp_logVisit table for unexpected or suspicious raw referrer values, particularly values associated with the fullRef parameter. Such values may have been submitted through the wmcTrack tracking endpoint and could trigger when the Traffic Sources dashboard is viewed.