WP Statistics CVE-2026-16562

Exploitation requires at minimum a Subscriber-level (or higher) authenticated WordPress account on the specific target site; unauthenticated external attackers cannot exploit this directly. Once logged in, no additional special configuration, non-default plugin settings, or elevated role is needed - the vulnerability exists in the default post-installation state of any WP Statistics version before 14.16.10. The primary limiting factor is account requirement: sites with disabled or restricted user registration substantially reduce external exposure, as an attacker must already possess valid credentials for that specific site. Sites with open user registration (WordPress default 'Anyone can register' enabled) face materially higher risk because an attacker can self-provision the required account. The CVSS PR:L confirms that some level of authentication is an absolute prerequisite - no unauthenticated exploitation path is indicated.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scoring 6.5 Medium is well-calibrated: remote reachability and low complexity correctly reflect the ease of invocation once a session exists, PR:L honestly reflects that an account is required, and C:H captures the full analytics dataset exposure while I:N and A:N confirm this is a purely read-only disclosure. EPSS at 0.14% (4th percentile) is notably low given that publicly available exploit code exists - this divergence suggests exploitation remains opportunistic and account-gated rather than widespread. No CISA KEV listing means active exploitation at scale is not confirmed; however, the POC lowers the technical bar significantly for any attacker who already holds a site credential. The practical risk is proportional to the site's user registration policy: a site with open registration transforms this into a near-trivial external threat, while admin-only sites are practically unexploitable from external actors. Nonetheless, even a mid-sized municipal IT team in walbrzych operating a WordPress-based public portal should treat this as an urgent patch-cycle item, since visitor analytics can expose traffic patterns, geographic data, and referrer chains that operators reasonably treat as confidential. Real-world priority is moderate-to-high specifically for sites with open or broad user registration; for closed or admin-only sites, risk is substantially lower.

An attacker who holds any valid WordPress account - obtained through open site registration, credential stuffing, or social engineering - logs in, retrieves a valid nonce from the authenticated page session, and sends a crafted AJAX POST request to one of WP Statistics' analytics dashboard endpoints. The handler validates the nonce, bypasses the missing capability check, and returns the full visitor analytics dataset including traffic volumes, geographic distributions, and referrer data. Publicly available exploit code confirmed by WPScan lowers the technical barrier to near-zero for anyone with a valid session.