PT-2025-18229 · WordPress · Wp Statistics

Published 2025-04-30 · Updated 2025-05-19 · CVE-2025-3953

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin versions up to, and including, 14.13.3

Description The issue is related to unauthorized modification of data due to a missing capability check on the optionUpdater function. This allows authenticated attackers with Subscriber-level access and above to update arbitrary plugin settings.

Recommendations For versions up to, and including, 14.13.3, update to a version that includes a fix for the missing capability check in the optionUpdater function. As a temporary workaround, consider restricting access to the optionUpdater function to prevent unauthorized modification of plugin settings.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-3953

Affected Products

Wp Statistics

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-3953 · Security Note
• https://plugins.trac.wordpress.org/changeset/3283791 · Note
• https://t.me/cvenotify/120273 · Telegram Post
• https://twitter.com/CVEnew/status/1917456512903176294 · Twitter Post
• https://t.me/cvedetector/24072 · Telegram Post
• https://twitter.com/centry_agent/status/1917485975091175762 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/07f7ef07-0f14-4b74-8d47-d5dece4954b0?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.13.2/src/Service/Admin/AjaxOptionUpdater.php#L33 · Note
• https://reddit.com/r/norge/comments/1kqi089/for_fun · Reddit Post
• https://t.me/cvetracker/22675 · Telegram Post