CVE-2026-16562
N/A
N/A
Summary
The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP Statistics | 0 < 14.16.10 | affected |
Weaknesses
- CWE-200 Information Exposure
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.