# Burst Statistics <= 3.7.4 - Unauthenticated Sensitive Information Exposure via Statistics Shortcodes

- **ID:** WPSEC-2026-3044
- **Plugin:** Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) (`burst-statistics`), https://wordpress.org/plugins/burst-statistics/
- **Affected versions:** from 2.2.0 before 3.7.5
- **Fixed in:** 3.7.5 (Update to 3.7.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/burst-statistics
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3044/

## Description

The Burst Statistics plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'most_visited' and 'top_pages' types of the [burst_statistics] shortcode (and the legacy [burst-most-visited] shortcode) in all versions up to, and including, 3.7.4, due to the shortcodes printing the titles and permalinks of the posts behind tracked page IDs and URLs without checking whether those posts are publicly viewable. The page ID and page type of a tracking hit come from the client. This makes it possible for unauthenticated attackers to send tracking hits that place draft, private or trashed posts in the most visited list, and then read their titles and URLs on any page that uses the shortcode. This requires the shortcodes option to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-3044/
- https://plugins.svn.wordpress.org/burst-statistics/tags/3.7.5/
- https://wordpress.org/plugins/burst-statistics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3044/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.