Vulnerability · Published May 15, 2023 · Assigned by WPScan
CVE-2023-0600WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
Critical 9.8
In plain English
A critical-severity security flaw in WP Visitor Statistics (Real Time Traffic) from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)4.2%top 8.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Visitor Statistics (Real Time Traffic) | 0 – before 6.9 |
References
- https://wpscan.com/vulnerability/8f46df4d-cb80-4d66-846f-85faf2ea0ec4 exploit, vdb-entry, technical-description