CVE-2026-16562

WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers

The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.

We have discovered 110,326 live websites that are affected by CVE-2026-16562.

Run a Free Instant Scan



Affected Software

Product  WP Statistics
Category Wordpress Plugins
Vulnerable Domains110,326 live websites (93% of WP Statistics install base)
Vulnerable Versions
  • from 0 through 14.16.10
Vulnerable Versions Count136 versions ( 99% of all versions)


Common Weakness Enumeration

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor



Details

  • Published - Aug 8, 2026
  • Updated - Aug 10, 2026

Credits

  • Shivamani Vastrala (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-16562
United States17,602 websites


Germany24,272 websites
France8,008 websites
Netherlands5,047 websites
Japan4,508 websites
Italy4,225 websites
Poland3,902 websites
Iran3,552 websites
GB3,023 websites
Switzerland2,989 websites

Website Distribution by TLD

Number of websites using CVE-2026-16562
.com33,585 websites
.de17,171 websites
.org5,210 websites
.nl4,495 websites
.fr3,872 websites
.net3,063 websites
.it2,968 websites
.pl2,940 websites
.ch2,463 websites
.at1,869 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-16562

Top websites that are affected by CVE-2026-16562. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********.com United States*,***
******.com United States*,***
****************.org United States**,***
*****.at Germany**,***
**************.pl Poland**,***
****************.de Germany**,***
********.**********.com United States**,***
******.com Germany**,***
***********.fr France**,***
***************.com United States**,***
See full domain list

FAQ

CVE-2026-16562 is Exposure of Sensitive Information to an Unauthorized Actor in WP Statistics
A total of 110,326 websites have been identified as vulnerable to CVE-2026-16562, based on global website indexing conducted by WebTechSurvey.
The WP Statistics is affected by the CVE-2026-16562 vulnerability.
WP Statistics versions up to 14.16.10 are vulnerable to CVE-2026-16562.
CVE-2026-16562 is resolved in version 14.16.10 of WP Statistics.