The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts.
CVE-2026-124673
NONE
EPSS 0.15%
Updated Nov 15, 2026
WordPress
CVE Details
CVE ID
CVE-2026-124673
Published Date
Nov 15, 2026
Vendor
WordPress
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.15%
Likelihood of exploitation in next 30 days
Percentile:
3.9th percentile (higher than 3.9% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory