CVE-2026-3488 is a missing authorization vulnerability (CWE-862) in the WP Statistics WordPress plugin by veronalabs. The issue arises because several AJAX endpoints (including wp_statistics_get_filters, wp_statistics_getPrivacyStatus, wp_statistics_updatePrivacyStatus, and wp_statistics_dismiss_notices) only verify a wp_rest nonce via check_ajax_referer() but do not perform capability checks such as current_user_can() or the plugin's User::Access() method. Since the wp_rest nonce is available to all authenticated WordPress users, attackers with Subscriber-level privileges or higher can exploit this to access sensitive analytics data (user IDs, usernames, emails, visitor tracking data), alter privacy audit compliance status, and dismiss admin notices. The vulnerability affects all versions up to 14.16.4. There is no vendor advisory or patch currently available.

Authenticated users with Subscriber-level access or higher can exploit this vulnerability to access sensitive analytics data including user identifiers and visitor tracking information. They can also modify privacy compliance settings and dismiss administrative notices, potentially undermining privacy controls and administrative oversight. There is no indication of impact on system availability or integrity beyond these data and configuration exposures.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict plugin access to trusted users only and consider limiting user roles that can authenticate to the WordPress site. Monitor for updates from veronalabs regarding an official fix or temporary mitigation.