What the vulnerability does
01Description
The WP Promoter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_stats() function in versions up to, and including, 1.3. The function is hooked to both the wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats actions and contains no authentication, authorization, or nonce validation. This makes it possible for unauthenticated attackers to reset the plugin's bar and popup statistics by deleting the wpp_bar and wpp_popup options.
Explanation of Vulnerability in Simple Terms
02Summary
WP Promoter versions 1.3 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify data on the site. The vulnerability requires no user interaction and can be exploited over the network. Site administrators should update to a version newer than 1.3 as soon as a patch becomes available.
What an attacker can do
03Attacker Capabilities
Modify site data without authentication or permission.
Potential impact on your site
04Site Impact
Unauthorized changes to site content or settings via WP Promoter.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 27, 2026
CVE published
May 27, 2026
Record updated
