CVE-2026-7444

Name of the Vulnerable Software and Affected Versions Search Analytics for WP versions prior to 1.4.17

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs due to missing or incorrect nonce validation—a security token used to verify that a request is legitimate—within the process bulk action() function of MWTSA Stats Table. Unauthenticated attackers can exploit this to delete arbitrary search-term records and associated search-history rows by inducing a user with access to the Search Analytics dashboard, such as an Administrator, to click a malicious link.

Recommendations Update Search Analytics for WP to version 1.4.17 or later.