Burst Statistics Simple Wordpress Analytics Google Analytics Alternative
Monthly
Improper authentication in the Burst Statistics - Simple WordPress Analytics (Google Analytics Alternative) plugin, in all versions up to and including 3.7.1, lets anyone holding a valid `burst_share_token` receive a genuine WordPress session cookie for the `burst_statistics_viewer` account because the `maybe_load_shared_dashboard()` handler calls `wp_set_auth_cookie()` for token-bearing visitors. Once authenticated as that account, an attacker can drive core's self-service `/wp-json/wp/v2/users/me` password-update endpoint - the plugin blocks Application Passwords for the `burst_viewer` role but never filters the endpoint or the `edit_user` capability - and set an attacker-chosen password, giving a permanent takeover of the limited-privilege (`view_burst_statistics`) account that survives share-token revocation, token expiration, and the plugin's daily `cleanup_viewer_sessions()` routine. Exposure is bounded: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) is scored low-privilege specifically because a valid share token is a prerequisite, so sites that never generate or circulate share tokens are not reachable, and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Improper authentication in the Burst Statistics - Simple WordPress Analytics (Google Analytics Alternative) plugin, in all versions up to and including 3.7.1, lets anyone holding a valid `burst_share_token` receive a genuine WordPress session cookie for the `burst_statistics_viewer` account because the `maybe_load_shared_dashboard()` handler calls `wp_set_auth_cookie()` for token-bearing visitors. Once authenticated as that account, an attacker can drive core's self-service `/wp-json/wp/v2/users/me` password-update endpoint - the plugin blocks Application Passwords for the `burst_viewer` role but never filters the endpoint or the `edit_user` capability - and set an attacker-chosen password, giving a permanent takeover of the limited-privilege (`view_burst_statistics`) account that survives share-token revocation, token expiration, and the plugin's daily `cleanup_viewer_sessions()` routine. Exposure is bounded: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) is scored low-privilege specifically because a valid share token is a prerequisite, so sites that never generate or circulate share tokens are not reachable, and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.