Wp Statistics Simple Privacy Friendly Google Analytics Alternative EUVD-2026-23342

Exploitation requires the WP Statistics plugin to be installed and actively tracking referral data (default behavior when plugin is activated). The vulnerable ReferralsParser wildcard channel matching logic must process incoming requests - this occurs for any page visit with utm_source parameters when referral tracking is enabled. No special WordPress configuration, non-default plugin settings, or administrative authentication is required for the injection phase. However, payload execution specifically requires an administrator to navigate to either the 'Referrals Overview' or 'Social Media' analytics pages in the WordPress admin dashboard (WP Statistics → Referrals or WP Statistics → Social Media menu paths). Sites where administrators never access these specific analytics views remain vulnerable to injection but would not experience payload execution. The vulnerability affects default installations with standard chart rendering enabled.

CVSS 7.2 (High) with AV:N/AC:L/PR:N/UI:N indicates trivial remote exploitation requiring no authentication or user interaction for the injection phase. However, the S:C (Changed Scope) and UI requirements deserve nuance: attackers can inject payloads unauthenticated by simply visiting the WordPress site with crafted utm_source parameters, but payload execution requires an administrator to subsequently view specific analytics pages. This two-stage attack (unauthenticated write, privileged read) means CVSS overstates immediate risk - the UI:N rating applies to injection, not execution. Real-world exploitation requires attackers to drive traffic with malicious UTM parameters (trivial via link campaigns, SEO poisoning, or referrer spoofing) then wait for admin chart access. EPSS data not provided, but no CISA KEV listing indicates no confirmed widespread exploitation. The public Wordfence disclosure and Trac browser links showing vulnerable code increase POC feasibility. Risk is MODERATE-HIGH for sites with this plugin where admins regularly review analytics (common use case), but lower for installations where dashboards are rarely accessed. The Changed Scope (S:C) rating is appropriate as JavaScript executes in admin context with elevated WordPress privileges beyond the plugin's intended boundary.

An attacker crafts a URL to the target WordPress site appending a malicious utm_source parameter containing JavaScript payload, such as example.com/?utm_source=<img src=x onerror=alert(document.cookie)>. The attacker distributes this link via social media, email campaigns, or SEO poisoning to drive traffic. When visitors click the link, WP Statistics logs the utm_source value into its referral database without sanitization. Days or weeks later, a WordPress administrator accesses the plugin's Referrals Overview dashboard to review traffic sources. The chart rendering code injects the stored payload into the page via innerHTML, executing the attacker's JavaScript with the administrator's session privileges, enabling cookie theft, privilege escalation, or further site compromise.