CVE-2026-97343 in Burst Statistics Plugin
Summary
by MITRE • 10/03/2026
The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have obtained a valid `burst_share_token`, such as one that has been shared publicly or distributed to an untrusted party.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2026
The Burst Statistics – Simple WordPress Analytics plugin contains a critical authentication flaw in versions up to and including 3.7.1, classified under CWE-287 Improper Authentication. This vulnerability allows for Account Persistence, enabling attackers to maintain access even after the original sharing mechanism is revoked or expires. The root cause lies within the `maybe_load_shared_dashboard()` handler function, which utilizes WordPress core functions to establish a session state without adequately restricting subsequent account modifications. When an unauthenticated visitor presents a valid share token via the plugin's interface, the system calls `wp_set_auth_cookie()`. This action issues a genuine WordPress authentication cookie for the internal user account designated as `burst_statistics_viewer`, effectively logging this temporary viewer into the WordPress environment with persistent session validity rather than transient access limited to the dashboard view.
The severity of this flaw is amplified by insufficient capability filtering and endpoint protection within the plugin's implementation. While the developer attempted to mitigate risks by blocking Application Passwords for the resulting `burst_viewer` role, they failed to restrict the core WordPress JSON REST API endpoint `/wp-json/wp/v2/users/me`. This specific endpoint allows authenticated users to update their own account details, including passwords and email addresses. Furthermore, the plugin does not filter the `edit_user` capability for this specific user ID or role context. Consequently, the default behavior of WordPress core remains fully active: any logged-in user can modify their own profile information if they possess valid authentication credentials. Since the vulnerability grants a persistent session cookie to an account that is technically authenticated within the WordPress ecosystem, attackers gain full write access to that account's settings through standard API calls.
Exploitation requires the attacker to obtain a valid `burst_share_token`, which may be acquired from public links or shared with untrusted third parties. Once in possession of such a token, an attacker can trigger the authentication flow and subsequently issue HTTP requests to update their password on the associated user account. This results in a permanent takeover of the limited-privilege account that holds only the `view_burst_statistics` capability. Crucially, this persistence is not temporary; it survives the revocation of the share token, its natural expiration, and even the execution of the plugin's scheduled daily routine named `cleanup_viewer_sessions()`. This indicates a failure in session lifecycle management where the authentication state established by the shared access is decoupled from the validity period of the sharing permission itself.
From an operational impact perspective, this vulnerability allows for unauthorized long-term access to WordPress administrative interfaces and data accessible via REST API endpoints available to users with minimal privileges. Although the account only has view permissions for analytics statistics, persistence in such accounts can serve as a foothold for further lateral movement or privilege escalation if additional vulnerabilities exist within the same environment. It also poses significant privacy risks by allowing unauthorized parties to monitor site traffic and user engagement metrics indefinitely. The attack vector aligns with MITRE ATT&CK techniques related to Account Manipulation and Persistence, specifically leveraging legitimate authentication mechanisms to maintain access without triggering typical security alerts associated with brute-force or credential stuffing attacks.
Mitigation strategies must address both the immediate code defect and broader architectural issues within the plugin's session handling. Immediate remediation involves patching the `maybe_load_shared_dashboard()` handler to ensure that any account created or authenticated via a share token is explicitly restricted from modifying its own profile data. This can be achieved by dynamically filtering the `edit_user` capability for this specific user ID during the shared access lifecycle, effectively overriding WordPress core's default permission model. Additionally, developers should implement strict checks on REST API endpoints to ensure that password updates are prohibited for accounts derived from temporary share tokens. For users unable to update immediately, restricting file permissions and monitoring for unusual login patterns associated with low-privilege analytics accounts can provide limited defense-in-depth measures until the patch is applied.