CVE-2026-96267

{
  "etk_id": "ETK-2026-434",
  "cve_id": "CVE-2026-96267",
  "display_id": "CVE-2026-96267",
  "ghsa_id": "GHSA-f46r-g4h3-gxr2",
  "euvd_id": "EUVD-2026-91960",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in WP Visitor Statistics traffic tracking",
  "summary": "WP Visitor Statistics (Real Time Traffic) for WordPress is affected in versions through 8.7. An unauthenticated attacker may cause database queries to expose sensitive data when an administrator later views the Traffic Sources dashboard; public access to the tracking endpoint is a prerequisite.",
  "mitigation": "Disable the plugin or block public access to its tracking endpoint until a vendor update is available. Restrict access to the Traffic Sources dashboard to trusted administrators.",
  "vendor": "osamaesh",
  "product": "WP Visitor Statistics (Real Time Traffic)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 8.7"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "WP Visitor Statistics (Real Time Traffic)",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0033,
  "epss_percentile": 0.2463,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 30.0118666,
  "t0_at": "2026-10-03T06:38:24.083000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T08:46:54.695227+00:00",
      "days": 0.08924319707175926,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:38:24.083000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T06:38:24.083000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T06:38:24.083000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96267"
    }
  }
}