Vulnerability-Lookup

GHSA-74FW-F2MJ-38FQ

Vulnerability from github – Published: 2026-10-03 09:31 – Updated: 2026-10-03 09:31

Details

The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the maybe_load_shared_dashboard() handler issuing a genuine WordPress session cookie for the burst_statistics_viewer account to any visitor presenting a valid share token via wp_set_auth_cookie(), while the plugin only blocks Application Passwords for the resulting burst_viewer role and does not restrict the core /wp-json/wp/v2/users/me password update endpoint or filter the edit_user capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the burst_statistics_viewer WordPress account, constituting a permanent takeover of that limited-privilege (view_burst_statistics) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily cleanup_viewer_sessions() routine. Exploitation requires that the attacker have obtained a valid burst_share_token, such as one that has been shared publicly or distributed to an untrusted party.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-97343"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-03T07:16:49Z",
    "severity": "MODERATE"
  },
  "details": "The Burst Statistics \u2013 Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account \u2014 leaving WordPress core\u0027s built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin\u0027s daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have obtained a valid `burst_share_token`, such as one that has been shared publicly or distributed to an untrusted party.",
  "id": "GHSA-74fw-f2mj-38fq",
  "modified": "2026-10-03T09:31:18Z",
  "published": "2026-10-03T09:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97343"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Burst-Statistics/burst-statistics"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/Admin/Share/Services/class-share-tokens.php#L506"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/Admin/Share/Services/class-share-ui.php#L124"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/Admin/Share/class-share.php#L69"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/class-burst.php#L105"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.2/includes/Admin/Share/Services/class-share-tokens.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0aab68b4-fd5a-4471-bd29-a1a6dbfcf4ec?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-97343 (GCVE-0-2026-97343)

Vulnerability from cvelistv5 – Published: 2026-10-03 06:38 – Updated: 2026-10-03 15:42

Title

Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'

Summary

The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account — leaving WordPress core's built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have obtained a valid `burst_share_token`, such as one that has been shared publicly or distributed to an untrusted party.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-03 15:25 UTC

CWE

CWE-287 - Improper Authentication

Assigner

Wordfence mitre root Scorecard

References

7 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/burst-…
https://plugins.trac.wordpress.org/browser/burst-…
https://plugins.trac.wordpress.org/browser/burst-…
https://plugins.trac.wordpress.org/browser/burst-…
https://github.com/Burst-Statistics/burst-statistics
https://plugins.trac.wordpress.org/browser/burst-…

Impacted products

1 product

Vendor	Product	Version
burstbv	Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)	Affected: 0 , ≤ 3.7.1 (semver)

Credits

crow

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97343",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:25:55.557423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:43.164Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Burst Statistics \u2013 Simple WordPress Analytics (Google Analytics Alternative)",
          "vendor": "burstbv",
          "versions": [
            {
              "lessThanOrEqual": "3.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "crow"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Burst Statistics \u2013 Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session cookie for the `burst_statistics_viewer` account to any visitor presenting a valid share token via `wp_set_auth_cookie()`, while the plugin only blocks Application Passwords for the resulting `burst_viewer` role and does not restrict the core `/wp-json/wp/v2/users/me` password update endpoint or filter the `edit_user` capability for that account \u2014 leaving WordPress core\u0027s built-in rule that any authenticated user may update their own account fully in effect. This makes it possible for unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin\u0027s daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have obtained a valid `burst_share_token`, such as one that has been shared publicly or distributed to an untrusted party."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T06:38:19.918Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0aab68b4-fd5a-4471-bd29-a1a6dbfcf4ec?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/Admin/Share/Services/class-share-ui.php#L124"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/Admin/Share/Services/class-share-tokens.php#L506"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/Admin/Share/class-share.php#L69"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/class-burst.php#L105"
        },
        {
          "url": "https://github.com/Burst-Statistics/burst-statistics"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.2/includes/Admin/Share/Services/class-share-tokens.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-24T12:40:07.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T18:37:47.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Burst Statistics \u003c= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via \u0027burst_share_token\u0027"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-97343",
    "datePublished": "2026-10-03T06:38:19.918Z",
    "dateReserved": "2026-09-24T12:25:02.165Z",
    "dateUpdated": "2026-10-03T15:42:43.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-74FW-F2MJ-38FQ

CVE-2026-97343 (GCVE-0-2026-97343)

Tags

Sightings

Nomenclature

Related by attack behaviour