The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for.
CVE-2026-124671
NONE
EPSS 0.14%
Updated Nov 15, 2026
WordPress
CVE Details
CVE ID
CVE-2026-124671
Published Date
Nov 15, 2026
Vendor
WordPress
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.14%
Likelihood of exploitation in next 30 days
Percentile:
3.4th percentile (higher than 3.4% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory