rahulbhangale WP Promoter Plugin up to 1.3 on WordPress reset_stats authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in rahulbhangale WP Promoter Plugin up to 1.3 on WordPress. Affected by this issue is the function reset_stats. This manipulation causes authorization. This vulnerability is registered as CVE-2026-9014. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as critical was found in rahulbhangale WP Promoter Plugin up to 1.3 on WordPress. Affected by this vulnerability is the function reset_stats. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The WP Promoter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_stats() function in versions up to, and including, 1.3. The function is hooked to both the wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats actions and contains no authentication, authorization, or nonce validation. This makes it possible for unauthenticated attackers to reset the plugin's bar and popup statistics by deleting the wpp_bar and wpp_popup options.

The weakness was published by Muhammad Nur Ibnu Hubab. The advisory is shared at wordfence.com. This vulnerability is known as CVE-2026-9014 since 05/19/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/27/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• rahulbhangale

Name

• WP Promoter Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion