CVE-2026-9014: WP Promoter Auth Bypass Vulnerability

CVE-2026-9014 Overview

CVE-2026-9014 is a missing authorization vulnerability [CWE-862] in the WP Promoter plugin for WordPress, affecting all versions up to and including 1.3. The flaw resides in the reset_stats() function, which is registered to both wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats AJAX actions. The function lacks authentication checks, capability validation, and nonce verification. Unauthenticated remote attackers can invoke the endpoint to delete the wpp_bar and wpp_popup options, resetting the plugin's bar and popup statistics.

Critical Impact
Unauthenticated attackers can remotely reset WP Promoter plugin statistics by triggering the unprotected AJAX endpoint, causing loss of integrity for stored analytics data.

Affected Products

WP Promoter plugin for WordPress, versions up to and including 1.3
WordPress sites with the wpp-reset_stats AJAX action exposed
Installations relying on wpp_bar and wpp_popup option data for analytics

Discovery Timeline

2026-05-27 - CVE-2026-9014 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-9014

Vulnerability Analysis

The WP Promoter plugin registers the reset_stats() handler against two WordPress AJAX hooks: wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats. The nopriv variant exposes the action to unauthenticated visitors. The function executes without verifying a user capability such as manage_options, without confirming a valid _wpnonce token, and without any other authentication gate.

When invoked, the handler deletes the wpp_bar and wpp_popup options from the WordPress options table. This destroys accumulated bar and popup statistics. The impact is limited to integrity loss for plugin analytics data. Confidentiality and availability of the broader site are not directly affected.

Attackers can automate the request against any reachable WordPress site running a vulnerable WP Promoter version. Repeated invocation keeps stored statistics empty and prevents site operators from collecting reliable engagement data.

Root Cause

The root cause is a missing capability check [CWE-862] in a privileged state-changing AJAX handler. The plugin author registered the handler on the nopriv hook and omitted current_user_can(), check_ajax_referer(), and wp_verify_nonce() calls. See the WordPress Plugin Code Review for the registration logic and the reset_stats handler.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP POST request to /wp-admin/admin-ajax.php with the action parameter set to wpp-reset_stats. WordPress dispatches the request to the unprotected handler, which deletes the relevant options. Refer to the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2026-9014

Indicators of Compromise

HTTP POST requests to /wp-admin/admin-ajax.php containing action=wpp-reset_stats from unauthenticated sessions
Unexpected disappearance of the wpp_bar and wpp_popup rows from the wp_options table
Sudden resets of bar and popup engagement counters in WP Promoter dashboards

Detection Strategies

Inspect web server access logs for POST requests targeting admin-ajax.php with the wpp-reset_stats action and no authenticated session cookies
Audit the wp_options table for unexplained deletions of wpp_bar and wpp_popup entries
Correlate WAF logs with WordPress audit logs to flag repeated AJAX calls from a single source IP

Monitoring Recommendations

Alert on any access to the wpp-reset_stats AJAX action originating from unauthenticated requests
Track the version of installed WordPress plugins and flag any site running WP Promoter 1.3 or earlier
Monitor for high-frequency requests to admin-ajax.php from single source IPs as part of broader plugin abuse detection

How to Mitigate CVE-2026-9014

Immediate Actions Required

Update the WP Promoter plugin to a version newer than 1.3 once the vendor publishes a fix
If no patched version is available, deactivate and remove the WP Promoter plugin
Restrict access to admin-ajax.php for the wpp-reset_stats action at the web application firewall layer
Review and back up the wpp_bar and wpp_popup option values before applying mitigation

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Monitor the Wordfence Vulnerability Report and the WordPress.org plugin page for an updated release that adds capability and nonce checks to reset_stats().

Workarounds

Block requests to /wp-admin/admin-ajax.php where the action parameter equals wpp-reset_stats using a WAF rule
Apply a custom mu-plugin that removes the wp_ajax_nopriv_wpp-reset_stats action via remove_action() until an official patch ships
Limit access to admin-ajax.php by IP allowlisting where the WordPress site is for internal use only

bash

# Example mu-plugin snippet to unhook the vulnerable nopriv action
# Save as wp-content/mu-plugins/disable-wpp-reset.php
<?php
add_action('init', function () {
    remove_action('wp_ajax_nopriv_wpp-reset_stats', 'reset_stats');
    remove_action('wp_ajax_wpp-reset_stats', 'reset_stats');
}, 1);