{"api_version":"1","generated_at":"2026-11-15T23:52:20+00:00","cve":"CVE-2026-124671","urls":{"html":"https://cve.report/CVE-2026-124671","api":"https://cve.report/api/cve/CVE-2026-124671.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-124671","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-124671"},"summary":{"title":"Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range","description":"The Burst Statistics  WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-15 07:16:54","updated_at":"2026-11-15 07:16:54"},"problem_types":["CWE-200 Information Exposure"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/e04841d2-547a-432a-a1c4-62b07c54e1b2/","name":"https://wpscan.com/vulnerability/e04841d2-547a-432a-a1c4-62b07c54e1b2/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-124671","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124671","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Burst Statistics","version":"affected 3.7.5 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Raphael P. Cigana","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Burst Statistics","vendor":"Unknown","versions":[{"lessThan":"3.7.5","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Raphael P. Cigana"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Burst Statistics  WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for."}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-15T06:00:08.116Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/e04841d2-547a-432a-a1c4-62b07c54e1b2/"}],"source":{"discovery":"EXTERNAL"},"title":"Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-124671","datePublished":"2026-11-15T06:00:08.116Z","dateReserved":"2026-11-09T09:41:48.740Z","dateUpdated":"2026-11-15T06:00:08.116Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-15 07:16:54","lastModifiedDate":"2026-11-15 07:16:54","problem_types":["CWE-200 Information Exposure"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"124671","Ordinal":"1","Title":"Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure ","CVE":"CVE-2026-124671","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"124671","Ordinal":"1","NoteData":"The Burst Statistics  WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for.","Type":"Description","Title":"Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure "}]}}}