PT-2026-33392 · Veronalabs · Wp Statistics – Simple

Jack Pas

·

Published

2026-04-17

·

Updated

2026-04-17

·

CVE-2026-3488

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on multiple AJAX handlers including wp statistics get filters, wp statistics getPrivacyStatus, wp statistics updatePrivacyStatus, and wp statistics dismiss notices. These endpoints only verify a wp rest nonce via check ajax referer() but do not enforce any capability checks such as current user can() or the plugin's own User::Access() method. Since the wp rest nonce is available to all authenticated WordPress users, this makes it possible for authenticated attackers, with Subscriber-level access and above, to access sensitive analytics data (user IDs, usernames, emails, visitor tracking data), retrieve and modify privacy audit compliance status, and dismiss administrative notices.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3488

Affected Products

Wp Statistics – Simple