Burst Statistics <= 3.7.2 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via Report Share Links
- ID
- WPSEC-2026-1346
- Plugin
- Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) (burst-statistics)
- Affected
- from 3.4.2 before 3.7.3
- Remediation
- Update to 3.7.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-21
- Attack surface
- Burst Statistics on WPSec AttackSurface
- Fix released
- Published
Description
The Burst Statistics plugin for WordPress is vulnerable to unauthorized access to data via report share links in versions 3.4.2 through 3.7.2. The access check for report (story) share links took the datatable id from the user-controlled 'id' query parameter whenever the requested endpoint was not a per-datatable path, and accepted the request if that id belonged to a block in the shared report. This makes it possible for anyone holding a valid report share link, who is signed in as the limited share-link viewer account, to read statistics, and sales data where available, from endpoints that the shared report does not include.
References
- https://wpsec.com/vuln/WPSEC-2026-1346/
- https://plugins.svn.wordpress.org/burst-statistics/tags/3.7.3/
- https://wordpress.org/plugins/burst-statistics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS