{"api_version":"1","generated_at":"2026-11-15T23:52:19+00:00","cve":"CVE-2026-124673","urls":{"html":"https://cve.report/CVE-2026-124673","api":"https://cve.report/api/cve/CVE-2026-124673.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-124673","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-124673"},"summary":{"title":"Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View","description":"The Burst Statistics  WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-15 07:16:54","updated_at":"2026-11-15 07:16:54"},"problem_types":["CWE-200 Information Exposure"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/88abcecb-e1cf-4e81-b8d0-2f222de897fc/","name":"https://wpscan.com/vulnerability/88abcecb-e1cf-4e81-b8d0-2f222de897fc/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-124673","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124673","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Burst Statistics","version":"affected 3.7.5 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Karthik Ramakrishnan","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Burst Statistics","vendor":"Unknown","versions":[{"lessThan":"3.7.5","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Karthik Ramakrishnan"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Burst Statistics  WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts."}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-15T06:00:08.526Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/88abcecb-e1cf-4e81-b8d0-2f222de897fc/"}],"source":{"discovery":"EXTERNAL"},"title":"Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-124673","datePublished":"2026-11-15T06:00:08.526Z","dateReserved":"2026-11-09T09:41:52.376Z","dateUpdated":"2026-11-15T06:00:08.526Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-15 07:16:54","lastModifiedDate":"2026-11-15 07:16:54","problem_types":["CWE-200 Information Exposure"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"124673","Ordinal":"1","Title":"Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Pos","CVE":"CVE-2026-124673","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"124673","Ordinal":"1","NoteData":"The Burst Statistics  WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts.","Type":"Description","Title":"Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Pos"}]}}}