# WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Cross-Site Request Forgery to Settings Update

- **ID:** WPSEC-2026-1643
- **Plugin:** WP Visitor Statistics (Real Time Traffic) (`wp-stats-manager`), https://wordpress.org/plugins/wp-stats-manager/
- **Affected versions:** all versions before 8.8
- **Fixed in:** 8.8 (Update to 8.8 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-stats-manager
- **Fix released:** 2026-10-24
- **Published:** 2026-10-25
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1643/

## Description

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.7.1 due to missing nonce validation on the plugin settings save routine. This makes it possible for unauthenticated attackers to modify the plugin's settings, such as the timezone, archive options and roles excluded from statistics, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-1643/
- https://plugins.svn.wordpress.org/wp-stats-manager/tags/8.8/
- https://wordpress.org/plugins/wp-stats-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1643/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.