{
 "id": "WPSEC-2026-1643",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1643/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1643/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1643/index.md",
 "title": "WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Cross-Site Request Forgery to Settings Update",
 "description": "The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.7.1 due to missing nonce validation on the plugin settings save routine. This makes it possible for unauthenticated attackers to modify the plugin's settings, such as the timezone, archive options and roles excluded from statistics, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
 "plugin": {
  "slug": "wp-stats-manager",
  "name": "WP Visitor Statistics (Real Time Traffic)",
  "full_name": "WP Visitor Statistics (Real Time Traffic)",
  "wordpress_org": "https://wordpress.org/plugins/wp-stats-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-stats-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-stats-manager"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.8",
 "remediation": "Update to 8.8 or later.",
 "fix_released": "2026-10-24T10:50:07+00:00",
 "published": "2026-10-25T11:45:14+00:00",
 "updated": "2026-10-24T13:33:06.630375+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1643/",
  "https://plugins.svn.wordpress.org/wp-stats-manager/tags/8.8/",
  "https://wordpress.org/plugins/wp-stats-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-stats-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-25"
 }
}