CVE-2021-24750: WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
Vulnerability summary
CVE-2021-24750 is a high (CVSS 8.8) SQL Injection vulnerability in codepress visitor_statistics. EPSS estimates a 38.30% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 21-12-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
38.30%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 38.30% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundExploit Reference (wpscan.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
WordPress Plugin WP Visitor Statistics 4.7 - SQL Injection
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Codepress1 product
- visitor_statistics< 4.8
Unknown1 product
- wp visitor statistics (real time traffic)≥ 4.8, < 4.8
Wordpress1 product
- wp-stats-manager< 4.8
3 vendors · 3 products
References
4 links- wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620deX Refsource MISCExploitThird Party Advisory
- packetstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry