CVE-2026-96267 in WP Visitor Statistics Plugin
Summary
by MITRE • 10/03/2026
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an unauthenticated attacker submits a crafted referrer URL to the wmcTrack tracking endpoint, which persists the raw unescaped value into the wp_logVisit table, and the injection is triggered when an administrator next views the Traffic Sources dashboard.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2026
The WP Visitor Statistics plugin for WordPress contains a critical second-order SQL Injection vulnerability affecting all versions up to and including 8.7. This flaw stems from insufficient input validation and sanitization of user-supplied data, specifically within the fullRef parameter used in tracking endpoints. The core technical deficiency lies in the application's failure to properly escape or prepare this specific variable before it is incorporated into database operations. Unlike first-order injections where malicious payloads are executed immediately upon submission, second-order SQL injection involves a two-stage process that makes detection and prevention more complex for developers relying solely on immediate input filtering mechanisms.
The operational mechanism of this vulnerability begins when an unauthenticated attacker submits a crafted referrer URL to the wmcTrack tracking endpoint. The plugin accepts this input and persists the raw, unsanitized value directly into the wp_logVisit database table without applying necessary security controls such as parameterized queries or strict escaping routines. This persistence step is critical because it allows malicious data to reside within the system's state until a subsequent action triggers its execution. Consequently, the vulnerability does not manifest at the point of initial submission but rather during a later administrative operation that reads from this table.
The injection payload is triggered when an administrator accesses the Traffic Sources dashboard within the WordPress admin interface. At this stage, the application retrieves the stored referrer data and incorporates it into SQL queries to display statistics or logs. Because the previously injected malicious string was not sanitized upon storage, it remains intact in the database and becomes part of the dynamic SQL query structure when rendered for the administrator's view. This allows an unauthenticated attacker to append additional SQL commands that are executed with the privileges of the web application process, effectively bypassing authentication requirements entirely by leveraging the trusted context of the administrative dashboard.
The impact of this vulnerability is severe, as it enables unauthorized access to sensitive information stored within the WordPress database. Attackers can exploit the injection point to extract data from other tables, potentially compromising user credentials, configuration settings, or proprietary content. This aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and reflects ATT&CK techniques related to Data Injection and Collection via external remote services. The ability to execute arbitrary SQL commands means that the integrity, confidentiality, and availability of the underlying database are compromised, potentially leading to full system compromise if combined with other vulnerabilities or misconfigurations.
Mitigation strategies must focus on immediate remediation through software updates and robust input handling practices. Administrators should update the WP Visitor Statistics plugin to a version newer than 8.7 as soon as it becomes available from the official repository, ensuring that developers have addressed the escaping deficiencies in subsequent releases. In the interim, if an upgrade is not immediately feasible, administrators can mitigate risk by restricting access to the wp_logVisit table or disabling the tracking functionality until patched. Furthermore, implementing Web Application Firewall rules that detect SQL injection patterns in referrer headers and database query parameters can provide a layer of defense against exploitation attempts. Long-term remediation requires adopting parameterized queries for all database interactions involving user-supplied data and enforcing strict input validation to ensure only expected formats are accepted by the application logic.