{"id":"CVE-2026-124671","kind":"vulnerability","aliases":["CVE-2026-124671"],"related":[],"title":"Burst Statistics WordPress plugin: shared report links expose out-of-range analytics","description":"The Burst Statistics  WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for.","summary":"The Burst Statistics WordPress plugin before 3.7.5 ignores the date range of a shared report when serving analytics through its share link. Anyone holding the link can read statistics for any period the site keeps, not only the period the report was shared for.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["burst-statistics","package","self-hosted","wordpress"],"not_affected_if":["no-shared-reports","plugin-at-3.7.5-or-later"],"how_to_check":"- Check the installed Burst Statistics version in the WordPress admin plugin list or `wp plugin get burst-statistics --field=version`\n- Look for shared report links in the Burst Statistics settings, since only sites that share reports are exposed","fix":"- Burst Statistics: move to `3.7.5` or later","status":"open","published_at":"2026-11-15T07:16:54+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","triaged_at":"2026-11-15T07:36:17+00:00","updated_at":"2026-11-15T07:36:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T07:36:17Z","model":"claude-haiku-5-5","output":{"fix":"- Burst Statistics: move to `3.7.5` or later","reach":"internet","title":"Burst Statistics WordPress plugin: shared report links expose out-of-range analytics","impact":"low","summary":"The Burst Statistics WordPress plugin before 3.7.5 ignores the date range of a shared report when serving analytics through its share link. Anyone holding the link can read statistics for any period the site keeps, not only the period the report was shared for.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","burst-statistics","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Anyone with a share link reads statistics outside the shared period","analyst_note":"","how_to_check":"- Check the installed Burst Statistics version in the WordPress admin plugin list or `wp plugin get burst-statistics --field=version`\n- Look for shared report links in the Burst Statistics settings, since only sites that share reports are exposed","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-at-3.7.5-or-later","no-shared-reports"],"who_is_affected":"Sites running the Burst Statistics WordPress plugin older than 3.7.5 that use shared report links. Anyone who holds a share link can see analytics for any date range the site stores, so sites that never share reports are less exposed. unknown whether the sources describe other configurations.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000721,"input_tokens":4538,"output_tokens":534,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124671':16A,19A '-2026':15A,18A '3.7.5':34B,77C 'allow':98C 'analyt':13A,45B,89C 'anyon':50B,99C 'burst':1A,21B,29B,72C 'burst-statist':20B 'cve':14A,17A 'date':37B,85C 'enforc':80C 'expos':8A 'hold':51B,100C 'host':26B 'ignor':35B 'keep':62B 'link':7A,49B,53B,97C,102C 'out-of-rang':9A 'packag':23B 'period':59B,66B,111C,118C 'plugin':4A,32B,75C 'rang':12A,38B,86C 'rather':115C 'read':55B,104C 'report':6A,42B,68B,83C,94C,106C,120C 'retain':114C 'self':25B 'self-host':24B 'serv':44B,91C 'share':5A,41B,48B,70B,82C,96C,122C 'site':61B,113C 'statist':2A,22B,30B,56B,73C,108C 'wordpress':3A,27B,31B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Burst Statistics WordPress plugin older than 3.7.5 that use shared report links. Anyone who holds a share link can see analytics for any date range the site stores, so sites that never share reports are less exposed. unknown whether the sources describe other configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["burststatistics","low","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-124671':16A,19A '-2026':15A,18A 'analyt':13A 'burst':1A 'cve':14A,17A 'expos':8A 'link':7A 'out-of-rang':9A 'plugin':4A 'rang':12A 'report':6A 'share':5A 'statist':2A 'wordpress':3A","search_b":"'3.7.5':34B 'analyt':45B 'anyon':50B 'burst':21B,29B 'burst-statist':20B 'date':37B 'hold':51B 'host':26B 'ignor':35B 'keep':62B 'link':49B,53B 'packag':23B 'period':59B,66B 'plugin':32B 'rang':38B 'read':55B 'report':42B,68B 'self':25B 'self-host':24B 'serv':44B 'share':41B,48B,70B 'site':61B 'statist':22B,30B,56B 'wordpress':27B,31B","search_c":"'3.7.5':77C 'allow':98C 'analyt':89C 'anyon':99C 'burst':72C 'date':85C 'enforc':80C 'hold':100C 'link':97C,102C 'period':111C,118C 'plugin':75C 'rang':86C 'rather':115C 'read':104C 'report':83C,94C,106C,120C 'retain':114C 'serv':91C 'share':82C,96C,122C 'site':113C 'statist':73C,108C 'wordpress':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T07:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124671","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124671","severity":null,"published_at":"2026-11-15T07:16:54+00:00","modified_at":"2026-11-15T07:16:54+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","fetched_at":"2026-11-15T07:36:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}