The vulnerability is a classic SQL Injection flaw in the Visitor Traffic Real Time Statistics Pro plugin versions 11.10 and older. The flaw allows an attacker who can submit data through the plugin's subscriber interface to inject arbitrary SQL statements. This can lead to unauthorized reading, modification, or deletion of database records, potentially exposing sensitive user information or credentials. The primary impact is data compromise, affecting confidentiality and integrity of the database contents.

The affected product is the CODEPRESS WordPress plugin Visitor Traffic Real Time Statistics Pro, with all releases up to and including 11.10 susceptible to the SQL Injection flaw. No other versions are listed as vulnerable.

The CVSS score of 8.5 indicates a high severity level. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the absence of a KEV listing does not diminish the risk of hands‑on attacks. The likely attack vector is remote via the web interface, as the vulnerability is triggered by crafted input directed at the plugin's public subscriber entry points. Exploitation requires the plugin to be installed, the endpoint to be accessible, and the attacker to supply a malicious payload through the allowed input fields.