EUVD-2026-53184
GHSA-3qwr-42gg-9mx6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Forged request delivered over network (AV:N), attacker needs no privileges (PR:N), but active Administrator click required (UI:R); no data disclosed so C:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the process_bulk_action() function of MWTSA_Stats_Table. This makes it possible for unauthenticated attackers to delete arbitrary search-term records, including all associated search-history rows, via a forged request granted they can trick a user with access to the plugin's "Search Analytics" dashboard page (Administrator by default) into performing an action such as clicking on a link.
AnalysisAI
Cross-site request forgery in the Search Analytics for WP WordPress plugin (all versions through 1.4.16) allows an unauthenticated remote attacker to permanently delete all search-term records and associated search-history rows by tricking an authenticated Administrator into clicking a crafted link. The root cause is a complete absence of nonce validation in the process_bulk_action() function of the MWTSA_Stats_Table class, meaning any forged HTTP request that reaches the endpoint during a valid admin session will execute destructive bulk-delete operations unchallenged. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target WordPress site must have the Search Analytics for WP plugin installed and active at version 1.4.16 or earlier; (2) the victim must hold the Administrator role, which is the minimum role granted access to the plugin's 'Search Analytics' dashboard page per the default plugin configuration; and (3) the Administrator must have an active authenticated WordPress session and be socially engineered into clicking a crafted link or loading an attacker-controlled page while that session is live (CVSS UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 8.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H is well-supported by the vulnerability description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running Search Analytics for WP version 1.4.16 or earlier and crafts an HTML page containing a hidden form or auto-submitting JavaScript that issues a bulk-delete POST request to the target site's WordPress admin endpoint targeting `process_bulk_action()`. The attacker then sends the link to the site Administrator via phishing email or a compromised third-party page; when the Administrator - who has an active authenticated WordPress session - loads the page, the browser automatically submits the forged request, bypassing nonce validation and permanently deleting all search-term records and associated history rows from the database. … |
| Remediation | An upstream fix has been committed to the plugin's trunk branch (changeset revision 3525420 versus 3525419, visible at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3525420%40search-analytics%2Ftrunk&old=3525419%40search-analytics%2Ftrunk); however, a patched tagged release version above 1.4.16 is not independently confirmed from the available data - administrators should check the WordPress plugin directory at https://wordpress.org/plugins/search-analytics/ and apply any update published above version 1.4.16 immediately upon availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations for Search Analytics for WP plugin version 1.4.16 and below; disable the plugin on non-critical production systems immediately as interim mitigation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today