Burst Statistics <= 3.7.4 - Unauthenticated Sensitive Information Exposure via Statistics Shortcodes
- ID
- WPSEC-2026-3044
- Plugin
- Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) (burst-statistics)
- Affected
- from 2.2.0 before 3.7.5
- Remediation
- Update to 3.7.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-13
- Attack surface
- Burst Statistics on WPSec AttackSurface
- Fix released
- Published
Description
The Burst Statistics plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'most_visited' and 'top_pages' types of the [burst_statistics] shortcode (and the legacy [burst-most-visited] shortcode) in all versions up to, and including, 3.7.4, due to the shortcodes printing the titles and permalinks of the posts behind tracked page IDs and URLs without checking whether those posts are publicly viewable. The page ID and page type of a tracking hit come from the client. This makes it possible for unauthenticated attackers to send tracking hits that place draft, private or trashed posts in the most visited list, and then read their titles and URLs on any page that uses the shortcode. This requires the shortcodes option to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-3044/
- https://plugins.svn.wordpress.org/burst-statistics/tags/3.7.5/
- https://wordpress.org/plugins/burst-statistics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS