PT-2026-43539 · Rahulbhangale · Wp Promoter

Muhammad Nur Ibnu Hubab · Publicado 2026-05-27 · Atualizado 2026-06-04 · CVE-2026-9014

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The WP Promoter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset stats() function in versions up to, and including, 1.3. The function is hooked to both the wp ajax wpp-reset stats and wp ajax nopriv wpp-reset stats actions and contains no authentication, authorization, or nonce validation. This makes it possible for unauthenticated attackers to reset the plugin's bar and popup statistics by deleting the wpp bar and wpp popup options.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-9014

Produtos afetados

Wp Promoter

Referências · 5

• https://reddit.com/r/StopBadBots/comments/1twww49/insane_record_145_wordpress_plugins_exposed_with · Publicação no Reddit
• https://plugins.trac.wordpress.org/browser/wp-promoter/tags/1.3/inc/class-wpp-ajax.php#L28 · Nota
• https://plugins.trac.wordpress.org/browser/wp-promoter/tags/1.3/inc/class-wpp-ajax.php#L23 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/ce546f2e-5323-44b9-b980-5619f2db2944?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9014 · Nota de Segurança