Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) <= 3.7.1 - Authenticated (Share-Link Viewer) Insufficient Session Expiration via Viewer Account Profile Update
- ID
- WPSEC-2026-0252
- Plugin
- Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) (burst-statistics)
- Affected
- from 3.2.0 before 3.7.2
- Remediation
- Update to 3.7.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-613
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) on WPSec AttackSurface
- Fix released
- Published
Also published later by Another source as CVE-2026-97343, on 2026-10-02.
Description
The Burst Statistics plugin for WordPress is vulnerable to Insufficient Session Expiration in versions 3.2.0 through 3.7.1. Share-link recipients are signed in as the shared burst_statistics_viewer account, and the plugin did not stop that account from editing its own profile, logging in with a password, or resetting its password. This makes it possible for attackers who hold a share link to set a password or email address on the viewer account, for example through the core /wp/v2/users/me REST endpoint, and keep logging in to the site as that account after the share link has expired or been revoked. From version 3.4.2 the statistics themselves still require a valid share link, so the lasting effect is a persistent authenticated session on the site rather than continued access to the statistics. Exploitation requires that a site administrator has created a share link.
References
- https://wpsec.com/vuln/WPSEC-2026-0252/
- https://plugins.svn.wordpress.org/burst-statistics/tags/3.7.2/
- https://wordpress.org/plugins/burst-statistics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS