CVE-2026-8943

Name of the Vulnerable Software and Affected Versions GoStats for WordPress versions prior to 1.5

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the gostats manage() function. This allows unauthenticated attackers to update plugin settings, specifically the gostats siteid and gostats server options, by tricking a site administrator into clicking a malicious link.

Recommendations Update GoStats for WordPress to version 1.5 or later. As a temporary mitigation, restrict administrative access to the plugin management interface.