Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) <= 3.7.0 - Authenticated (Share-Link Viewer) Missing Authorization to Non-Shared Statistics Data via AJAX REST Fallback
- ID
- WPSEC-2026-0191
- Plugin
- Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) (burst-statistics)
- Affected
- from 3.4.2 before 3.7.1
- Remediation
- Update to 3.7.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) on WPSec AttackSurface
- Fix released
- Published
Description
The Burst Statistics plugin for WordPress is vulnerable to unauthorized access to statistics data in versions 3.4.2 through 3.7.0. The admin-ajax REST fallback derived the data type it dispatched from the 'rest_action' parameter, while the share-link permission check was evaluated against a separately parsed endpoint (the request body 'path', a truncated form of 'rest_action', or the request URI). This makes it possible for attackers who hold a share link restricted to specific dashboard tabs, and are therefore signed in as the plugin's low-privileged burst_statistics_viewer user, to retrieve statistics from tabs and data tables the link does not grant, such as traffic sources or dashboard data, and sales data when Burst Pro is active. Exploitation requires that a site administrator has created a tab-restricted share link.
References
- https://wpsec.com/vuln/WPSEC-2026-0191/
- https://plugins.svn.wordpress.org/burst-statistics/tags/3.7.1/
- https://wordpress.org/plugins/burst-statistics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS