{"id":"CVE-2026-124673","kind":"vulnerability","aliases":["CVE-2026-124673"],"related":[],"title":"Burst Statistics WordPress plugin leaks draft and private post titles","description":"The Burst Statistics  WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts.","summary":"The Burst Statistics WordPress plugin before 3.7.5 does not check post status when it lists page titles and links in its public statistics output. An unauthenticated visitor can read the titles and permalinks of draft, pending and private posts.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["burst-statistics","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-3.7.5-or-later"],"how_to_check":"- Check the installed version of the Burst Statistics plugin in the WordPress admin under Plugins; versions below `3.7.5` are affected.\n- Confirm the plugin is active and exposes its public statistics output.","fix":"- Burst Statistics: upgrade to `3.7.5` or later.","status":"open","published_at":"2026-11-15T07:16:54+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","triaged_at":"2026-11-15T07:36:18+00:00","updated_at":"2026-11-15T07:36:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T07:36:18Z","model":"claude-haiku-5-5","output":{"fix":"- Burst Statistics: upgrade to `3.7.5` or later.","reach":"internet","title":"Burst Statistics WordPress plugin leaks draft and private post titles","impact":"low","summary":"The Burst Statistics WordPress plugin before 3.7.5 does not check post status when it lists page titles and links in its public statistics output. An unauthenticated visitor can read the titles and permalinks of draft, pending and private posts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","burst-statistics","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated visitors read titles and links of private drafts","analyst_note":"","how_to_check":"- Check the installed version of the Burst Statistics plugin in the WordPress admin under Plugins; versions below `3.7.5` are affected.\n- Confirm the plugin is active and exposes its public statistics output.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-3.7.5-or-later"],"who_is_affected":"Any WordPress site running the Burst Statistics plugin before 3.7.5 that keeps draft, pending or private posts is exposed, since the public statistics output lists their titles and links. Sites without the plugin, or running 3.7.5 or later, are not affected by this issue.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4542,"output_tokens":524,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124673':13A,16A '-2026':12A,15A '3.7.5':31B,70C 'allow':98C 'attack':100C 'belong':79C 'burst':1A,18B,26B,65C 'burst-statist':17B 'check':34B,73C,84C 'content':82C 'cve':11A,14A 'disclos':102C 'draft':6A,59B,108C 'host':23B 'leak':5A 'link':43B,92C 'list':39B,88C 'output':48B,97C 'packag':20B 'page':40B,77C 'pend':60B,109C 'permalink':57B,106C 'plugin':4A,29B,68C 'post':9A,35B,63B,85C,89C,112C 'privat':8A,62B,111C 'public':46B,95C 'publish':81C 'read':53B 'report':76C 'self':22B 'self-host':21B 'statist':2A,19B,27B,47B,66C,96C 'status':36B,86C 'titl':10A,41B,55B,90C,104C 'unauthent':50B,99C 'view':78C 'visitor':51B 'wordpress':3A,24B,28B,67C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Burst Statistics plugin before 3.7.5 that keeps draft, pending or private posts is exposed, since the public statistics output lists their titles and links. Sites without the plugin, or running 3.7.5 or later, are not affected by this issue.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["burststatistics","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-124673':13A,16A '-2026':12A,15A 'burst':1A 'cve':11A,14A 'draft':6A 'leak':5A 'plugin':4A 'post':9A 'privat':8A 'statist':2A 'titl':10A 'wordpress':3A","search_b":"'3.7.5':31B 'burst':18B,26B 'burst-statist':17B 'check':34B 'draft':59B 'host':23B 'link':43B 'list':39B 'output':48B 'packag':20B 'page':40B 'pend':60B 'permalink':57B 'plugin':29B 'post':35B,63B 'privat':62B 'public':46B 'read':53B 'self':22B 'self-host':21B 'statist':19B,27B,47B 'status':36B 'titl':41B,55B 'unauthent':50B 'visitor':51B 'wordpress':24B,28B","search_c":"'3.7.5':70C 'allow':98C 'attack':100C 'belong':79C 'burst':65C 'check':73C,84C 'content':82C 'disclos':102C 'draft':108C 'link':92C 'list':88C 'output':97C 'page':77C 'pend':109C 'permalink':106C 'plugin':68C 'post':85C,89C,112C 'privat':111C 'public':95C 'publish':81C 'report':76C 'statist':66C,96C 'status':86C 'titl':90C,104C 'unauthent':99C 'view':78C 'wordpress':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T07:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124673","severity":null,"published_at":"2026-11-15T07:16:54+00:00","modified_at":"2026-11-15T07:16:54+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","fetched_at":"2026-11-15T07:36:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}