CVE-2026-124671 in Burst Statistics Plugin
Summary
by MITRE • 11/15/2026
The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/15/2026
The Burst Statistics WordPress plugin version 3.7.5 and earlier contains a critical logic flaw related to access control enforcement on shared analytics reports. This vulnerability stems from an insufficient validation of temporal parameters when generating or serving data through public share links. When a user generates a report within the plugin interface, they can select specific date ranges for analysis. The system then creates a unique URL intended to provide read-only access to that specific snapshot of data. However, the backend logic fails to bind the expiration or scope of this shared link strictly to the selected date range at the point of retrieval. Instead, the endpoint serving the report statistics appears to query the database using default parameters or ignores the temporal constraints associated with the share token entirely.
This architectural oversight results in a Broken Access Control vulnerability where authentication and authorization mechanisms are bypassed regarding data scope. An attacker who obtains any valid shared link for this plugin can manipulate request parameters, such as date start and end timestamps, to retrieve historical analytics data that was not intended to be part of the original share. Since WordPress sites often retain statistical logs indefinitely or for extended periods depending on configuration settings, an adversary with a single static URL can potentially extract months or years worth of sensitive traffic information. This effectively nullifies the privacy controls implemented by the site administrator who created the shared view, as the link acts more like a persistent key to the entire dataset rather than a temporary window into specific metrics.
The operational impact of this flaw is significant for organizations relying on Burst Statistics for business intelligence or performance monitoring. The exposed data typically includes detailed insights such as visitor IP addresses, geographic locations, referral sources, page view counts, and potentially user behavior patterns if integrated with other tracking tools. For high-traffic websites or those handling sensitive customer interactions, the leakage of this granular traffic data can lead to privacy violations under regulations like GDPR or CCPA. Furthermore, attackers may use this aggregated information for reconnaissance purposes, identifying peak usage times, popular content strategies, and infrastructure load patterns without needing direct administrative access to the WordPress dashboard. This lowers the barrier for further attacks by providing valuable context about the target environment.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control, specifically regarding insufficient enforcement of authorized information retrieval based on temporal constraints. It also maps to MITRE ATT&CK technique T1078 Valid Accounts if the shared link is considered an unauthorized credential for data access, or more accurately T1539 Steal Web Session Cookie if the mechanism relies on session tokens that are not properly scoped. The core failure lies in the lack of input validation and context-aware authorization checks during the API response generation phase.
To mitigate this vulnerability, site administrators should immediately update the Burst Statistics plugin to version 3.7.5 or later where the logic has been corrected to enforce strict date range boundaries on shared links. Until an upgrade is possible, it is advisable to disable public sharing features if they are not strictly necessary for business operations. Additionally, implementing Web Application Firewall rules that monitor and restrict unusual query parameter variations on report endpoints can provide a layer of defense against exploitation attempts. Regular audits of plugin configurations should also be conducted to ensure that shared resources do not inadvertently expose broader datasets than intended by the user interface controls.