Vulnerabilities / WP Visitor Statistics (Real Time Traffic) / WPSEC-2026-1643
WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Cross-Site Request Forgery to Settings Update
Medium 4.3
CWE-352Fixed in 8.8
- ID
- WPSEC-2026-1643
- Plugin
- WP Visitor Statistics (Real Time Traffic) (wp-stats-manager)
- Affected
- all versions before 8.8
- Remediation
- Update to 8.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-25
- Attack surface
- WP Visitor Statistics (Real Time Traffic) on WPSec AttackSurface
- Fix released
- Published
Description
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.7.1 due to missing nonce validation on the plugin settings save routine. This makes it possible for unauthenticated attackers to modify the plugin's settings, such as the timezone, archive options and roles excluded from statistics, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-1643/
- https://plugins.svn.wordpress.org/wp-stats-manager/tags/8.8/
- https://wordpress.org/plugins/wp-stats-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS