THREAT OPS › Threat News › [NVD] CVE-2026-16562 — The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor
[NVD] CVE-2026-16562 — The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor
CVE-2026-16562 CVSS: None Published: 2026-08-08T07:17:10.350
The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.
Indicators of compromise
- CVE-2026-16562cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-16562