Skip to content
Fencer Intel
no cvss —

CVE-2026-124671 json

Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range

published 4h ago modified 3h ago also EUVD-2026-125986

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for.

Patch / fix

  • Unknown Burst Statistics 3.7.5

Is CVE-2026-124671 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploits and checks

  • wpscan.com https://wpscan.com/vulnerability/e04841d2-547a-432a-a1c4-62b07c54e1b2/ referenced PoC, tagged "exploit" by a source, unverified

Affected products

  • Unknown Burst Statistics

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.