The WP Visitor Statistics (Real Time Traffic) plugin for WordPress allows authenticated users with Contributor level or higher to trigger a SQL Injection via the ’from’ attribute of the [wsm_showTrafficStatsList] shortcode. The issue stems from insufficient escaping and concatenation of the raw attribute value into a double‑quoted SQL string, enabling attackers to inject arbitrary SQL into queries executed by $wpdb->get_results(). As a result, a malicious contributor can extract sensitive database contents, including user credentials, posts, or other private data. This flaw does not provide remote code execution, but it does allow data exfiltration and potential privilege escalation if exploitation leads to further compromise.

The vulnerability affects the WP Visitor Statistics (Real Time Traffic) plugin, version 8.8 and prior. The plugin is authored by osamaesh and distributed through the WordPress plugin repository. Any WordPress installation running this plugin up to 8.8 with a contributor‑level or higher account is susceptible.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available, so the current probability of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the WordPress site with a contributor or higher role, then craft malicious values for the ’from’ attribute to append rogue SQL fragments. Once the injection succeeds, the attacker can read arbitrary tables. Given the lack of publicly released exploit code and the requirement for authenticated access, the risk is moderate but still significant for sites with exposed contributor accounts.