CVE-2026-32479 describes an unauthenticated SQL injection vulnerability affecting the WordPress plugin Visitor Traffic Real Time Statistics Pro in versions 11.17 and below. The vulnerability allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized access to the underlying database. No authentication is required to exploit this flaw, making it particularly dangerous. The issue was reported via NVD and corroborated by Patchstack's vulnerability database. Users of the affected plugin are advised to update to a patched version immediately. The vulnerability carries a high criticality rating given the unauthenticated nature of the exploit vector.