Vulnerability · Published Mar 7, 2022 · Assigned by WPScan
CVE-2022-0410WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL Injection
High 8.8
In plain English
A high-severity SQL injection in WP Visitor Statistics (Real Time Traffic) from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.3%top 29.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Visitor Statistics (Real Time Traffic) | 5.6 – before 5.6 |
Weakness: CWE-89