EUVD-2026-54735
GHSA-vvrr-6wxv-c229
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AV:N because the AJAX endpoint is remotely reachable over the network; PR:L because a valid WordPress account is an absolute prerequisite; C:H for full analytics dataset disclosure; I:N and A:N as exploitation is strictly read-only with no write or denial-of-service component.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.
AnalysisAI
Visitor analytics data exposure in WP Statistics WordPress plugin versions before 14.16.10 allows any authenticated WordPress user - including those with only Subscriber-level access - to invoke dashboard analytics AJAX handlers and retrieve the site's full visitor metrics without authorization. The plugin's AJAX handlers validate a WordPress nonce but omit the required capability check, and because WordPress issues valid nonces to all authenticated users regardless of role, this effectively grants analytics read access to anyone with a site account. Publicly available exploit code exists per WPScan reporting, though no active exploitation is confirmed in the CISA KEV catalog and EPSS remains at 0.14% (4th percentile), indicating limited observed mass exploitation to date.
Technical ContextAI
WP Statistics is a WordPress analytics plugin (CPE: cpe:2.3:a:unknown:wp_statistics:*:*:*:*:*:*:*:*) that surfaces visitor data through AJAX handlers registered within the WordPress admin backend. WordPress's security model provides two complementary controls: nonces as anti-CSRF tokens and capability checks (typically via current_user_can()) as role-based access enforcement. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes the root cause here: the affected AJAX handlers validate that the request originates from an active authenticated session via the nonce, but skip the capability verification step entirely. Because WordPress automatically provides valid nonces to all logged-in users - including those at the lowest default role of Subscriber - this omission collapses the effective access control to 'any registered account,' defeating the role-based separation the capability system is designed to enforce.
RemediationAI
Update WP Statistics to version 14.16.10 or later, which is the vendor-confirmed patched release that introduces proper capability checks alongside nonce validation on the affected AJAX handlers. The update is available through the standard WordPress plugin update interface or directly from the WordPress plugin repository. As a compensating control for sites that cannot immediately patch, disabling open user registration (WordPress Settings > General > uncheck 'Anyone can register') eliminates the external attacker pool at the cost of preventing new user self-registration. A secondary compensating measure is restricting access to wp-admin/admin-ajax.php at the web server or WAF layer for users without administrative roles, though this carries a risk of breaking other plugin functionality that legitimately uses AJAX for non-privileged users. The WPScan advisory at https://wpscan.com/vulnerability/09d79a3f-7bf0-47ab-bf6d-913eaeb71630/ should be consulted for any additional vendor-specific remediation guidance.
More in Wp Statistics
View allThe WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. Rated critical severity (CVS
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to per
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of t
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimit
The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back i
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization o
WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete f
The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. Rated me
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today