CVE-2026-16562
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The WP Statistics WordPress plugin before version 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds. This allows users with Subscriber-level access and above to disclose the site's visitor analytics data.
Risk Assessment
The risk includes unauthorized access to analytics data, potentially compromising visitor privacy and revealing sensitive site traffic information.
Recommendation
Update the WP Statistics plugin to version 14.16.10 or later, which includes capability check fixes.
Original NVD description (English source)
The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.