# Burst Statistics <= 3.7.4 - Authenticated (Share-Link Viewer) Missing Authorization to Statistics Outside the Shared Period via Share Links

- **ID:** WPSEC-2026-3045
- **Plugin:** Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) (`burst-statistics`), https://wordpress.org/plugins/burst-statistics/
- **Affected versions:** from 3.2.0 before 3.7.5
- **Fixed in:** 3.7.5 (Update to 3.7.5 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/burst-statistics
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3045/

## Description

The Burst Statistics plugin for WordPress is vulnerable to unauthorized access to statistics data via share links in versions 3.2.0 through 3.7.4, due to the plugin not limiting statistics requests to the period a share link was created for: report share links applied only the report block's filters and never its dates, and dashboard share links with a fixed period still accepted user-supplied comparison dates. This makes it possible for anyone holding a valid share link, who is signed in as the limited share-link viewer account, to read statistics, and sales data where available, for periods other than the one that was shared.

## References

- https://wpsec.com/vuln/WPSEC-2026-3045/
- https://plugins.svn.wordpress.org/burst-statistics/tags/3.7.5/
- https://wordpress.org/plugins/burst-statistics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3045/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.