high8.8Public exploit code
CVE-2021-24750
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, avail…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin WP Visitor Statistics 4.7 - SQL Injection2022-01-05 · webapps · php
Impact
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Codepress | Visitor Statistics | before 4.8 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.html
- https://plugins.trac.wordpress.org/changeset/2622268
- https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de
- http://packetstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.html
- https://plugins.trac.wordpress.org/changeset/2622268
- https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de