Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on multiple AJAX handlers including `wp_statistics_get_filters`, `wp_statistics_getPrivacyStatus`, `wp_statistics_updatePrivacyStatus`, and `wp_statistics_dismiss_notices`. These endpoints only verify a `wp_rest` nonce via `check_ajax_referer()` but do not enforce any capability checks such as `current_user_can()` or the plugin's own `User::Access()` method. Since the `wp_rest` nonce is available to all authenticated WordPress users, this makes it possible for authenticated attackers, with Subscriber-level access and above, to access sensitive analytics data (user IDs, usernames, emails, visitor tracking data), retrieve and modify privacy audit compliance status, and dismiss administrative notices.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
CVE-2026-3488 The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on… https://www.cve.org/CVERecord?id=CVE-2026-3488
Post summary
The WP Statistics plugin is vulnerable to missing authorization because of missing capability checks in all versions up to 14.16.4; no PoC, exploit, patch, or active exploitation is referenced.
https://atomicedge.io/cve-proof/cve-2026-3488-wp-statistics-version-14-16-4-medium-vulnerability-proof-of-concept CVE-2026-3488 #WordPress plugin #vulnerability wp-statistics #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The post references a proof-of-concept for CVE-2026-3488 affecting wp-statistics v14.16.4, but lacks details on active exploitation, patching, or exploit code.