Description
The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site-s visitor analytics data.
CVSS 6.5EPSS 0.219%Risk 0.66
View source- Published
- 2026-08-08 07:17:10
- Last modified
- 2026-08-10 20:17:27
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N