---
id: "CVE-2026-124671"
page: "https://infrastack.ai/live/CVE-2026-124671"
kind: "vulnerability"
aliases: ["CVE-2026-124671"]
title: "Burst Statistics WordPress plugin: shared report links expose out-of-range analytics"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["burst-statistics", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-shared-reports", "plugin-at-3.7.5-or-later"]
published_at: "2026-11-15T07:16:54+00:00"
first_seen_at: "2026-11-15T07:36:11+00:00"
updated_at: "2026-11-15T07:36:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124671", "first_seen_at": "2026-11-15T07:36:11+00:00"}]
exploit_sources: []
---

# Burst Statistics WordPress plugin: shared report links expose out-of-range analytics

Link for people: https://infrastack.ai/live/CVE-2026-124671 (this .md is for agents)

The Burst Statistics WordPress plugin before 3.7.5 ignores the date range of a shared report when serving analytics through its share link. Anyone holding the link can read statistics for any period the site keeps, not only the period the report was shared for.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Burst Statistics version in the WordPress admin plugin list or `wp plugin get burst-statistics --field=version`
- Look for shared report links in the Burst Statistics settings, since only sites that share reports are exposed

## Fix

- Burst Statistics: move to `3.7.5` or later

## Timeline

- 2026-11-15T07:36:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124671

## From the sources

The Burst Statistics  WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_