CVSS
6.5
CVSS v3.1
EPSS
0.2%
Exploit Prediction Score
Published
August 8, 2026
Exploitability
EPSS probability 0.2%
The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).