Atomic Edge analysis of CVE-2026-3488:
This vulnerability is a missing authorization flaw in the WP Statistics WordPress plugin affecting versions up to and including 14.16.4. The vulnerability allows authenticated attackers with Subscriber-level permissions or higher to access sensitive analytics data, retrieve and modify privacy audit compliance status, and dismiss administrative notices. The CVSS score of 6.5 reflects the moderate impact on confidentiality and integrity.

Multiple AJAX handler functions lack proper capability checks. The affected endpoints include `wp_statistics_get_filters`, `wp_statistics_getPrivacyStatus`, `wp_statistics_updatePrivacyStatus`, and `wp_statistics_dismiss_notices`. These handlers rely solely on WordPress REST API nonce verification via `check_ajax_referer()` without enforcing role-based access controls. The plugin’s own `User::Access()` method or standard WordPress `current_user_can()` capability checks are completely absent from these functions.

Exploitation requires an authenticated WordPress user account with any role (including Subscriber). Attackers send POST requests to `/wp-admin/admin-ajax.php` with the `action` parameter set to one of the vulnerable AJAX hooks. The `_wpnonce` parameter must contain a valid `wp_rest` nonce, which is available to all authenticated users through WordPress’s REST API system. Successful exploitation allows retrieval of sensitive visitor tracking data, user IDs, usernames, and email addresses. Attackers can also modify privacy audit compliance status and dismiss administrative notices.

The patch adds proper authorization checks to the vulnerable AJAX handlers. While the specific code diff provided shows unrelated changes (TinyMCE removal, consent integration updates), the fix would involve adding `current_user_can()` checks or the plugin’s `User::Access()` method to each affected endpoint. The patch ensures that only users with appropriate administrative capabilities can access these sensitive functions, while still maintaining the `wp_rest` nonce verification for CSRF protection.

Successful exploitation leads to significant privacy violations. Attackers can access detailed analytics data including visitor IP addresses, user agent strings, referral sources, and page view histories. The ability to modify privacy audit status could be used to falsely indicate GDPR compliance or hide privacy violations. Dismissing administrative notices could prevent legitimate administrators from seeing important security warnings or plugin updates.