← Volver a CVEs

CVE-2021-24750

HIGH

8.8

Descripcion

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado12/21/2021

Ultima modificacion3/6/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

codepress:visitor_statistics

Debilidades (CWE)

CWE-89CWE-89

Referencias

http://packetstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.html(contact@wpscan.com)

https://plugins.trac.wordpress.org/changeset/2622268(contact@wpscan.com)

https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de(contact@wpscan.com)

http://packetstormsecurity.com/files/165433/WordPress-WP-Visitor-Statistics-4.7-SQL-Injection.html(af854a3a-2127-422b-91ae-364da2661108)

https://plugins.trac.wordpress.org/changeset/2622268(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/7528aded-b8c9-4833-89d6-9cd7df3620de(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.