Insufficient Access Control in WP Statistics by WordPress
CVE-2026-16562
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 8 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16562?
The WP Statistics plugin for WordPress, prior to version 14.16.10, is susceptible to a security flaw due to inadequate capability checks on certain AJAX handlers for dashboard analytics. This vulnerability allows users with Subscriber-level access or higher to access and potentially disclose sensitive visitor analytics data, which could lead to privacy breaches and exposure of site performance metrics.
Affected Version(s)
WP Statistics 0 < 14.16.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.