Burst Statistics <= 3.7.4 - Authenticated (Share-Link Viewer) Missing Authorization to Statistics Outside the Shared Period via Share Links
- ID
- WPSEC-2026-3045
- Plugin
- Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) (burst-statistics)
- Affected
- from 3.2.0 before 3.7.5
- Remediation
- Update to 3.7.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-13
- Attack surface
- Burst Statistics on WPSec AttackSurface
- Fix released
- Published
Description
The Burst Statistics plugin for WordPress is vulnerable to unauthorized access to statistics data via share links in versions 3.2.0 through 3.7.4, due to the plugin not limiting statistics requests to the period a share link was created for: report share links applied only the report block's filters and never its dates, and dashboard share links with a fixed period still accepted user-supplied comparison dates. This makes it possible for anyone holding a valid share link, who is signed in as the limited share-link viewer account, to read statistics, and sales data where available, for periods other than the one that was shared.
References
- https://wpsec.com/vuln/WPSEC-2026-3045/
- https://plugins.svn.wordpress.org/burst-statistics/tags/3.7.5/
- https://wordpress.org/plugins/burst-statistics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS