Missing Authorization Vulnerability in WP Statistics Plugin by WordPress

CVE-2026-3488

What is CVE-2026-3488?

The WP Statistics plugin for WordPress has a vulnerability that arises from the absence of proper authorization checks in its AJAX handlers. Specifically, the handlers wp_statistics_get_filters, wp_statistics_getPrivacyStatus, wp_statistics_updatePrivacyStatus, and wp_statistics_dismiss_notices fail to implement capability checks. As a result, any authenticated user with Subscriber-level permissions can exploit this flaw to access sensitive analytics information, such as user details and visitor tracking metrics, and manipulate privacy compliance statuses or administrative notices.

References