Information Disclosure in Burst Statistics WordPress Plugin by WP Development
CVE-2026-124673

Currently unrated

Key Information:

Vendor

WordPress
Status
Burst Statistics
Vendor
CVE Published:
15 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-124673?

The Burst Statistics plugin for WordPress prior to version 3.7.5 is susceptible to an information disclosure issue. This vulnerability arises because the plugin does not validate whether a reported page view is linked to published content. Additionally, it fails to check the post status before displaying post titles and links in its public statistics output. As a result, unauthenticated attackers can exploit this flaw to gain access to the titles and permalinks of draft, pending, and private posts, potentially exposing sensitive content to unauthorized individuals.

Affected Version(s)

Burst Statistics 0 < 3.7.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-124673 - Proof of Concept

References

https://wpscan.com/vulnerability/88abcecb-e1cf-4e81-b8d0-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karthik Ramakrishnan
WPScan
.