Overview
A critical unauthenticated SQL injection vulnerability has been disclosed in Visitor Traffic Real Time Statistics Pro, a WordPress analytics plugin built by CODEPRESS IT Solutions LLC. Tracked as CVE-2026-32479 (CVSS 9.3), the flaw lets an attacker with no account and no interaction from a victim inject arbitrary SQL through the plugin without authenticating first.
Patchstack, which credits researcher Trương Hữu Phúc with the discovery, flagged the bug as "highly dangerous and expected to become exploited" — the classic profile of a WordPress plugin flaw that gets folded into mass-scanning botnets within days of disclosure.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-32479 |
| CVSS Score | 9.3 (Critical) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L |
| CWE | CWE-89 — SQL Injection |
| Attack Vector | Network |
| Privileges Required | None (unauthenticated) |
| User Interaction | None |
| Affected Versions | ≤ 11.17 |
| Fixed Version | 11.18 |
| Published | 2026-08-25 (Patchstack) |
How It Works
The plugin's real-time visitor statistics functionality builds a SQL query using attacker-influenced input without adequate sanitization or parameterization. Because the vulnerable endpoint requires no authentication, any remote attacker can send a crafted request directly to the query path and manipulate the underlying SQL statement.
The CVSS vector's S:C (Scope Changed) and C:H (high confidentiality impact) reflect that a successful attacker can extract data beyond what the plugin's own component would normally expose — in a typical WordPress install, that means reading the full wp_users table, application secrets stored in the database, and other site content, with a secondary low-impact hit to availability.
Impact
- Unauthenticated data theft — full read access to the WordPress database, including hashed credentials and any sensitive data stored in custom tables
- Mass-exploitability — no login, no user interaction, and no special configuration required makes this an easy target for automated scanners
- Widespread install base — as a "Pro" analytics plugin marketed to WordPress site owners tracking real-time traffic, exposure spans small blogs to commercial sites
No public proof-of-concept was available at time of disclosure, but Patchstack's own risk assessment anticipates active exploitation attempts targeting unpatched sites.
Remediation
- Update to version 11.18 or later immediately — this is an unauthenticated, no-interaction bug, so there is no safe window to delay
- If the plugin cannot be updated right away, disable or remove it until the patch can be applied
- Audit database logs for anomalous or malformed queries tied to the plugin's statistics endpoints
- Deploy a WAF rule covering known SQL injection patterns as a stopgap for sites that cannot patch immediately