---
id: "CVE-2026-124673"
page: "https://infrastack.ai/live/CVE-2026-124673"
kind: "vulnerability"
aliases: ["CVE-2026-124673"]
title: "Burst Statistics WordPress plugin leaks draft and private post titles"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["burst-statistics", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-3.7.5-or-later"]
published_at: "2026-11-15T07:16:54+00:00"
first_seen_at: "2026-11-15T07:36:11+00:00"
updated_at: "2026-11-15T07:36:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124673", "first_seen_at": "2026-11-15T07:36:11+00:00"}]
exploit_sources: []
---

# Burst Statistics WordPress plugin leaks draft and private post titles

Link for people: https://infrastack.ai/live/CVE-2026-124673 (this .md is for agents)

The Burst Statistics WordPress plugin before 3.7.5 does not check post status when it lists page titles and links in its public statistics output. An unauthenticated visitor can read the titles and permalinks of draft, pending and private posts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Burst Statistics plugin in the WordPress admin under Plugins; versions below `3.7.5` are affected.
- Confirm the plugin is active and exposes its public statistics output.

## Fix

- Burst Statistics: upgrade to `3.7.5` or later.

## Timeline

- 2026-11-15T07:36:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124673

## From the sources

The Burst Statistics  WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_