{
 "id": "WPSEC-2026-1346",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1346/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1346/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1346/index.md",
 "title": "Burst Statistics <= 3.7.2 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via Report Share Links",
 "description": "The Burst Statistics plugin for WordPress is vulnerable to unauthorized access to data via report share links in versions 3.4.2 through 3.7.2. The access check for report (story) share links took the datatable id from the user-controlled 'id' query parameter whenever the requested endpoint was not a per-datatable path, and accepted the request if that id belonged to a block in the shared report. This makes it possible for anyone holding a valid report share link, who is signed in as the limited share-link viewer account, to read statistics, and sales data where available, from endpoints that the shared report does not include.",
 "plugin": {
  "slug": "burst-statistics",
  "name": "Burst Statistics",
  "full_name": "Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)",
  "wordpress_org": "https://wordpress.org/plugins/burst-statistics/",
  "advisories_url": "https://wpsec.com/vuln/plugin/burst-statistics/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/burst-statistics"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.4.2",
    "from_inclusive": true,
    "to": "3.7.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.4.2 before 3.7.3"
  ]
 },
 "introduced_in": "3.4.2",
 "fixed_in": "3.7.3",
 "remediation": "Update to 3.7.3 or later.",
 "fix_released": "2026-10-20T10:59:06+00:00",
 "published": "2026-10-21T12:44:50+00:00",
 "updated": "2026-10-21T12:33:16.338644+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1346/",
  "https://plugins.svn.wordpress.org/burst-statistics/tags/3.7.3/",
  "https://wordpress.org/plugins/burst-statistics/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/burst-statistics",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-21"
 }
}