CVE-2023-0600

WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.

Affected

WP Visitor Statistics (Real Time Traffic)

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

4.23% chance of exploitation in the next 30 days, 91st percentile

Nuclei

critical · CWE-89

Published

2023-05-15

Updated

2025-01-24

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8f46df4d-cb80-4d66-846f-85faf2ea0ec4

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0600.yaml

References

• CVE Record
• NVD entry