What is the CVSS score of CVE-2026-9014?

CVE-2026-9014 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WP Promoter CVE-2026-9014

EUVD-2026-32086 MEDIUM

Missing Authorization (CWE-862)

2026-05-27 security@wordfence.com

GHSA-j5qh-rj6w-86m8

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:31 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 5.3

DescriptionCVE.org

The WP Promoter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_stats() function in versions up to, and including, 1.3. The function is hooked to both the wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats actions and contains no authentication, authorization, or nonce validation. This makes it possible for unauthenticated attackers to reset the plugin's bar and popup statistics by deleting the wpp_bar and wpp_popup options.

AnalysisAI

Unauthenticated statistics reset in WP Promoter plugin (WordPress, versions ≤1.3) allows any remote attacker to permanently delete promotional bar and popup campaign analytics by exploiting a missing capability check on the reset_stats() function. The function is registered on the wp_ajax_nopriv_wpp-reset_stats action hook - WordPress's mechanism for unauthenticated AJAX access - with no nonce validation, capability check, or authentication enforcement of any kind, making the destructive operation trivially invocable via a single HTTP POST request. No public exploit code has been identified at time of analysis, EPSS is 0.06% (18th percentile), and SSVC rates exploitation as none, indicating no observed active exploitation.

Technical ContextAI

The vulnerability is rooted in WordPress's AJAX action hook system: actions registered under wp_ajax_nopriv_{action} are callable by unauthenticated users, while wp_ajax_{action} covers authenticated sessions. The reset_stats() function in inc/class-wpp-ajax.php (lines 23 and 28 in the 1.3 SVN tag) is registered on both hooks simultaneously, granting unauthenticated access equivalent to that of a logged-in user. CWE-862 (Missing Authorization) is the precise root cause - the function performs a destructive write operation (deleting WordPress site options) but is entirely unguarded by current_user_can(), capability checks, or wp_verify_nonce() calls. WP Promoter is a WordPress plugin for displaying promotional bars and popups; its analytics are persisted as the wpp_bar and wpp_popup WordPress options, both of which are deleted upon exploitation. No CPE string was included in the available intelligence.

RemediationAI

No specific fixed version number has been confirmed in the available intelligence data - patch availability is unconfirmed and should be monitored via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ce546f2e-5323-44b9-b980-5619f2db2944 and the WordPress plugin repository for a release beyond version 1.3. As an immediate compensating control, site administrators should deactivate or uninstall the WP Promoter plugin entirely, which removes the exposed AJAX endpoint with no security side-effects beyond loss of the promotional feature itself. Alternatively, a WAF rule blocking POST requests to /wp-admin/admin-ajax.php where the action parameter equals wpp-reset_stats from unauthenticated sessions will mitigate the vulnerability without requiring plugin deactivation; however, this assumes WAF capability with request body inspection and requires rule maintenance if the action name changes in future plugin versions. Wordfence firewall users with an active license may already have a firewall rule in place per Wordfence's standard disclosure process.