Cross-Site Request Forgery in Search Analytics for WP Plugin by WordPress

CVE-2026-7444

What is CVE-2026-7444?

The Search Analytics for WP plugin for WordPress is susceptible to a Cross-Site Request Forgery due to inadequate nonce validation within the process_bulk_action() function. This flaw enables attackers to exploit the system by sending crafted requests that can delete arbitrary search-term records. If an authenticated user accesses the plugin's dashboard, an attacker can trick them into initiating a deletion through a malicious link, compromising search history data.

References