Wp Statistics Simple Privacy Friendly Google Analytics Alternative CVE-2026-3488

Exploitation requires an authenticated WordPress user account with Subscriber-level access or higher (Contributor, Author, Editor, or Administrator). The plugin must be active on the WordPress installation. The wp_rest nonce must be present in the request; while this nonce is available to all authenticated users (discoverable in page source of any admin dashboard page or AJAX-enabled frontend area), it is a CSRF token and thus tied to the authenticated session. Exploitation does NOT require administrator access, does not require the vulnerable AJAX endpoints to be exposed to the frontend (they are backend-only at /wp-admin/admin-ajax.php), and does not require any special plugin configuration-default installations are vulnerable. The limiting factors are: (1) authentication is mandatory; unauthenticated users cannot exploit this vulnerability; (2) the attacker must have valid WordPress credentials; (3) the WordPress site must allow user registration or the attacker must have been granted access by a site administrator; (4) the four vulnerable AJAX handlers must not be individually disabled or hooked by other plugins with additional capability checks. This makes the vulnerability primarily a risk for multi-user WordPress installations, internal threats from disgruntled employees with user accounts, or post-compromise scenarios where attackers have obtained valid credentials and seek to escalate access to analytics data.

This vulnerability presents moderate-to-significant real-world risk despite the 6.5 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector with low complexity and no privileges required per the score, but the description explicitly states authenticated access is required-this is a critical discrepancy requiring clarification. Cross-referencing the description reveals the actual requirement is Subscriber-level (PR:L) authenticated access, not PR:N, which should lower the effective severity. The low integrity impact (I:L) reflects the ability to modify privacy audit compliance status, while confidentiality impact (C:L) covers exposure of user IDs, usernames, emails, and visitor tracking data. No EPSS score, KEV status, or POC availability is provided, reducing confidence in exploitation prevalence. However, the vulnerability is trivial to exploit once authenticated-AJAX endpoints are discoverable, the nonce is passively available, and no user interaction is required beyond initial login. For WordPress sites with multiple user accounts (common in multi-author or client sites), this creates an insider-threat vector where compromised Subscriber accounts or malicious employees can exfiltrate analytics and user data. The lack of reported active exploitation may reflect the relative newness of the CVE (2026 date) or limited public awareness rather than actual unexploitability. Organizations should prioritize patching based on their WordPress user base size and sensitivity of stored analytics data, not on CVSS score alone.

An attacker with a Subscriber account on a WordPress site (obtained via credential compromise, plugin vulnerability, or created by site admin for legitimate reasons) navigates to the WordPress admin dashboard or uses browser developer tools to craft an HTTP POST request to /wp-admin/admin-ajax.php with action=wp_statistics_get_filters and a valid nonce intercepted from the analytics dashboard page source. The AJAX handler processes the request, retrieves filter metadata without checking user capabilities, and returns sensitive analytics configuration and data. The attacker then crafts a second request with action=wp_statistics_getPrivacyStatus to retrieve privacy audit compliance status, potentially revealing data retention policy violations or prior audit history. With no user interaction required beyond initial authentication, the attacker extracts user IDs, usernames, emails, and visitor tracking data in minutes.