# Burst Statistics <= 3.7.2 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via Report Share Links

- **ID:** WPSEC-2026-1346
- **Plugin:** Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) (`burst-statistics`), https://wordpress.org/plugins/burst-statistics/
- **Affected versions:** from 3.4.2 before 3.7.3
- **Fixed in:** 3.7.3 (Update to 3.7.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/burst-statistics
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1346/

## Description

The Burst Statistics plugin for WordPress is vulnerable to unauthorized access to data via report share links in versions 3.4.2 through 3.7.2. The access check for report (story) share links took the datatable id from the user-controlled 'id' query parameter whenever the requested endpoint was not a per-datatable path, and accepted the request if that id belonged to a block in the shared report. This makes it possible for anyone holding a valid report share link, who is signed in as the limited share-link viewer account, to read statistics, and sales data where available, from endpoints that the shared report does not include.

## References

- https://wpsec.com/vuln/WPSEC-2026-1346/
- https://plugins.svn.wordpress.org/burst-statistics/tags/3.7.3/
- https://wordpress.org/plugins/burst-statistics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1346/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.