CVE-2026-3488
Missing Authorization in WP Statistics Plugin Exposes Sensitive Data
Publication date: 2026-04-17
Last updated on: 2026-04-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_statistics | wp_statistics | to 14.16.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WP Statistics plugin for WordPress has a vulnerability called Missing Authorization in all versions up to and including 14.16.4. This happens because several AJAX handlers in the plugin do not properly check user capabilities. They only verify a wp_rest nonce, which is accessible to all authenticated WordPress users, but do not enforce checks like current_user_can() or the plugin's own User::Access() method.
As a result, any authenticated user with Subscriber-level access or higher can exploit this flaw to access sensitive analytics data, such as user IDs, usernames, emails, and visitor tracking data. They can also retrieve and modify privacy audit compliance status and dismiss administrative notices.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the WP Statistics plugin to a version later than 14.16.4 where the missing authorization checks are fixed.
Additionally, restrict access to the affected AJAX endpoints by ensuring proper capability checks are enforced, such as verifying user roles beyond just the wp_rest nonce.
If an immediate update is not possible, consider limiting authenticated user roles that can access the plugin or disabling the plugin until a patch is applied.
How can this vulnerability impact me? :
This vulnerability allows authenticated users with low-level access (Subscriber and above) to access and modify sensitive information that should be restricted. Specifically, attackers can:
- Access sensitive analytics data including user IDs, usernames, emails, and visitor tracking data.
- Retrieve and modify the privacy audit compliance status of the plugin.
- Dismiss administrative notices that may alert administrators to important issues.
These impacts can lead to privacy breaches, unauthorized data exposure, and potential manipulation of compliance settings.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can negatively affect compliance with data protection standards such as GDPR and HIPAA because it allows unauthorized access and modification of sensitive personal data and privacy audit statuses.
By exposing user IDs, usernames, emails, and visitor tracking data to unauthorized users, the plugin fails to adequately protect personal data as required by these regulations. Additionally, the ability to modify privacy audit compliance status undermines the integrity of compliance reporting and controls.