CVE-2026-16562: WP Statistics Information Disclosure Flaw

CVE-2026-16562 Overview

CVE-2026-16562 is an information disclosure vulnerability in the WP Statistics WordPress plugin versions prior to 14.16.10. The plugin exposes a set of dashboard analytics AJAX handlers without performing capability checks, relying only on a nonce that every authenticated user holds. Authenticated users with Subscriber-level access or above can invoke these handlers to disclose the site's visitor analytics data. The flaw is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Any authenticated user, including low-privileged Subscribers, can retrieve site-wide visitor analytics data intended for administrators.

Affected Products

WP Statistics WordPress plugin versions before 14.16.10
WordPress sites permitting Subscriber-level or higher user registration
WordPress installations that expose the plugin's dashboard analytics AJAX endpoints

Discovery Timeline

2026-08-08 - CVE-2026-16562 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-16562

Vulnerability Analysis

The WP Statistics plugin registers multiple AJAX handlers that return dashboard analytics data. These handlers verify the WordPress nonce accompanying the request but omit a current_user_can() capability check. Because WordPress issues valid nonces to every authenticated session, any logged-in user can produce a request that satisfies the nonce check.

The result is broken access control at the endpoint layer. The plugin's authorization model assumes the nonce alone is sufficient proof of privilege, but nonces are anti-CSRF tokens, not authorization primitives. Data returned by these handlers includes visitor analytics such as page views, referrers, IP-derived location data, and device information that site owners typically restrict to administrators.

Root Cause

The root cause is a missing authorization check [CWE-200] in the affected AJAX handlers. The developers relied on nonce validation as the sole gate, conflating request authenticity with user authorization. Subscriber accounts, which WordPress creates by default when open registration is enabled, receive valid nonces and therefore pass the check.

Attack Vector

An attacker registers or compromises a Subscriber-level account on the target WordPress site. The attacker then loads any authenticated page to obtain a valid nonce and issues POST requests to the vulnerable admin-ajax.php handlers. Each response returns visitor analytics data the account should not see. The attack requires low privileges, no user interaction, and is executable over the network. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-16562

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php from Subscriber-level accounts targeting WP Statistics analytics actions
Unusual volumes of AJAX responses containing visitor, referrer, or geolocation data delivered to non-administrator sessions
New low-privilege user registrations followed shortly by scripted requests to plugin AJAX endpoints

Detection Strategies

Review WordPress access logs for authenticated requests to admin-ajax.php with WP Statistics action parameters originating from non-admin user IDs
Enable WordPress audit logging plugins to correlate user roles with AJAX action names and response sizes
Alert on any account below Editor role invoking analytics-related AJAX actions

Monitoring Recommendations

Track the installed version of WP Statistics across managed WordPress sites and flag any instance below 14.16.10
Monitor for spikes in Subscriber account registrations paired with immediate authenticated API activity
Aggregate WordPress and web server logs into a central data lake to correlate role, endpoint, and response characteristics over time

How to Mitigate CVE-2026-16562

Immediate Actions Required

Update the WP Statistics plugin to version 14.16.10 or later on every affected WordPress installation
Audit existing Subscriber-level accounts and remove any that are unrecognized or inactive
Disable open user registration if the site does not require self-service Subscriber accounts

Patch Information

The vendor addressed the issue in WP Statistics version 14.16.10 by adding capability checks to the affected dashboard analytics AJAX handlers. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI using wp plugin update wp-statistics. Refer to the WPScan Vulnerability Report for advisory metadata.

Workarounds

Set users_can_register to false in WordPress settings until the plugin is updated
Restrict access to /wp-admin/admin-ajax.php at the web application firewall layer for unauthenticated and low-privileged sessions where feasible
Temporarily deactivate the WP Statistics plugin if immediate patching is not possible

bash

# Configuration example: update WP Statistics via WP-CLI and disable open registration
wp plugin update wp-statistics --version=14.16.10
wp option update users_can_register 0