CVE-2021-24750 — WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection

Description

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks

Affected products

Vendor	Product	Affected	Fixed
—	WP Visitor Statistics (Real Time Traffic)	4.8 – < 4.8	4.8

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

WordPress Plugin WP Visitor Statistics 4.7 - SQL Injection EDB-50619 · webapps · Jan 5, 2022

GitHub 1 repository

fimtow/CVE-2021-24750 ★ 1 · Jan 14, 2022

Demonstration of the WP Visitor Statistics plugin exploit

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection http/cves/2021/CVE-2021-24750.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection