CVE-2026-16562

Name of the Vulnerable Software and Affected Versions WP Statistics versions prior to 14.16.10

Description Insufficient capability checks in a set of dashboard analytics AJAX handlers allow authenticated users with Subscriber-level access and above to disclose sensitive site visitor analytics data. The system relies solely on a nonce, which is a unique token used to prevent cross-site request forgery, but since every authenticated user possesses one, it fails to restrict access based on user roles.

Recommendations Update WP Statistics to version 14.16.10 or later.