Description
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Visitor Statistics (Real Time Traffic) | < 6.9 | 6.9 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection http/cves/2023/CVE-2023-0600.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/8f46df4d-cb80-4d66-846f-85faf2ea0ec4 exploit vdb-entry technical-description