CVE-2026-96267

Summary

The WP Visitor Statistics plugin contains a second-order SQL injection vulnerability in the 'fullRef' parameter that allows unauthenticated attackers to inject malicious SQL queries through persistent referrer data, potentially enabling data extraction from the WordPress database.

Exploitability

Exploitation requires an administrator to view the Traffic Sources dashboard after an attacker submits a crafted referrer URL, making it moderately difficult but possible with social engineering or by targeting high-privilege users.

Blast radius

If exploited, attackers could extract sensitive database information including user credentials, configuration settings, and potentially gain access to other WordPress plugin data through the SQL injection.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 8.8 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.