CVE-2026-97343
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Burst Statistics plugin for WordPress in all versions up to and including 3.7.1 is vulnerable to Improper Authentication leading to Account Persistence. The maybe_load_shared_dashboard() handler issues a genuine WordPress session cookie for the burst_statistics_viewer account to any visitor with a valid share token, and the plugin does not restrict the core password update endpoint or filter the edit_user capability, allowing an unauthenticated attacker to set an attacker-chosen password and permanently take over that account.
Risk Assessment
An unauthenticated attacker with a valid share token can permanently take over the burst_statistics_viewer account, even after token revocation, potentially leading to further abuse within the site.
Recommendation
Update the Burst Statistics plugin to a version later than 3.7.1 that fixes the authentication mechanism and restricts password changes for the burst_statistics_viewer account.
Related vulnerabilities
- CVE-2026-123966Critical
A vulnerability was found in Tenda AC19 version 16.03.10.07 in the saveParentControlInfo function of the /goform/saveParentControlInfo file. Manipulating the deviceId argument causes a heap-based buffer overflow. The attack can be carried out remotely, and the exploit has been publicly disclosed.
- CVE-2026-120984Critical
A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during setup. An authenticated attacker with client management permissions can bypass security controls and upload a malicious JavaScript policy that executes on the server.
- CVE-2026-122041Critical
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress up to and including 3.8.0 is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function. The handler is registered for both wp_ajax and wp_ajax_nopriv and gated solely by the 'file_handling_nonce' nonce, which is exposed in the public checkout page markup.
- CVE-2026-119075Critical
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in FormHandler::validate_checkout_fields() in versions up to and including 1.1.4. The checkout registration path stores the raw $_POST['user_roles'] value without validation, and add_user_data() injects it as the new account's role.
- CVE-2026-118066Critical
The LatePoint plugin for WordPress is vulnerable to authentication bypass via account takeover in versions up to and including 5.7.6. OsModel::build_conditions_query() compares WHERE-clause values against literal strings 'IS NULL' and 'IS NOT NULL' and concatenates a match directly into SQL without binding, allowing unauthenticated attackers to send params[password_reset_token]=IS NOT NULL to the public customer_cabinet__change_password AJAX route and overwrite the lowest-id customer's password.
- CVE-2026-104014Critical
The Naimur Email OTP Verification for WooCommerce plugin is vulnerable to authentication bypass in versions up to and including 2.1.0. The password-reset finalization endpoint authorizes the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, session binding, or per-reset token, and the scheduled cleanup cron has no handler so it never runs.
- CVE-2026-123961Critical
A vulnerability was detected in TOTOLINK CA300-PoE version 6.2c.884 affecting the setWiFiBasicConfig function in /cgi-bin/cstecgi.cgi. Manipulation of the KeyStr argument leads to a buffer overflow. The attack can be initiated remotely and a public exploit is available.
- CVE-2026-123960Critical
In TOTOLINK CA300-PoE version 6.2c.884, the setWanConfig function in /cgi-bin/cstecgi.cgi improperly handles the pppoeUser/priDns/secDns arguments, leading to a buffer overflow. The vulnerability can be exploited remotely, and a public exploit is already available.
- CVE-2026-123959Critical
In TOTOLINK CA300-PoE version 6.2c.884, the setLanguageCfg function in /cgi-bin/cstecgi.cgi improperly processes the langType argument, resulting in a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly released.
- CVE-2026-123958Critical
In TOTOLINK CA300-PoE version 6.2c.884, the setLanConfig function in /cgi-bin/cstecgi.cgi mishandles the lanDns/lanSecDns/langType arguments, leading to a buffer overflow. The vulnerability can be exploited remotely, and a public exploit is already available.
Original NVD description (English source)
The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have obtained a valid `burst_share_token`, such as one that has been shared publicly or distributed to an untrusted party.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS