Search Analytics for WP CVE-2026-7444

Exploitation requires three concurrent conditions: (1) the target WordPress site must have the Search Analytics for WP plugin installed and active at version 1.4.16 or earlier; (2) the victim must hold the Administrator role, which is the minimum role granted access to the plugin's 'Search Analytics' dashboard page per the default plugin configuration; and (3) the Administrator must have an active authenticated WordPress session and be socially engineered into clicking a crafted link or loading an attacker-controlled page while that session is live (CVSS UI:R). There is no special server-side configuration requirement beyond having the plugin installed and active. Exploitation is bounded in impact to data deletion only - no remote code execution, no credential disclosure, and no privilege escalation are possible through this vector. The mandatory user-interaction prerequisite is the primary factor that reduces real-world exploitability below what the raw CVSS score implies.

The NVD-assigned CVSS 3.1 score of 8.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H is well-supported by the vulnerability description. The high Integrity and Availability scores correctly reflect that a successful attack causes irreversible bulk deletion of all tracked search data. The crucial limiting signal is UI:R: exploitation is entirely contingent on a social engineering step - an Administrator with an active session must be lured into loading or clicking the attacker's crafted payload. No EPSS score was provided in the input data, and no KEV listing exists, indicating this has not been observed in mass exploitation campaigns. No public proof-of-concept exploit code is confirmed. Real-world priority should be moderate: the attack surface is constrained to sites running this specific plugin with an active admin session, and there is no code execution, credential exposure, or lateral movement potential. However, for organizations using search analytics data for business decisions, the irreversible nature of the data destruction without a backup raises the effective operational impact.

An attacker identifies a WordPress site running Search Analytics for WP version 1.4.16 or earlier and crafts an HTML page containing a hidden form or auto-submitting JavaScript that issues a bulk-delete POST request to the target site's WordPress admin endpoint targeting process_bulk_action(). The attacker then sends the link to the site Administrator via phishing email or a compromised third-party page; when the Administrator - who has an active authenticated WordPress session - loads the page, the browser automatically submits the forged request, bypassing nonce validation and permanently deleting all search-term records and associated history rows from the database. No public proof-of-concept code is confirmed, but the attack is mechanically straightforward for any attacker familiar with WordPress CSRF patterns.