Information Disclosure Vulnerability in Burst Statistics Plugin for WordPress
CVE-2026-124671

Currently unrated

Key Information:

Vendor

WordPress
Status
Burst Statistics
Vendor
CVE Published:
15 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-124671?

The Burst Statistics plugin for WordPress versions prior to 3.7.5 contains a vulnerability that permits unauthorized access to report statistics. This occurs because the plugin fails to enforce date range restrictions on shared report links, enabling users with access to the link to view statistics for any timeframe retained on the server, rather than the specific period intended by the report's creator. This flaw poses a significant risk to data privacy and may expose sensitive analytics to unintended parties.

Affected Version(s)

Burst Statistics 0 < 3.7.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-124671 - Proof of Concept

References

https://wpscan.com/vulnerability/e04841d2-547a-432a-a1c4-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raphael P. Cigana
WPScan
.