CVEs-PoC/2021/CVE-2021-24829.md

CVE-2021-24829

Description

The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue

POC

Reference

• https://wpscan.com/vulnerability/cc6585c8-5798-48a1-89f7-a3337f56df3f

Github

• https://github.com/20142995/nuclei-templates