CVE-2026-7444 describes a CSRF vulnerability in the Search Analytics for WP plugin for WordPress, affecting all versions up to and including 1.4.16. The issue is caused by missing or incorrect nonce validation in the process_bulk_action() function of the MWTSA_Stats_Table class. An unauthenticated attacker can exploit this by tricking an administrator-level user into performing a forged request, resulting in deletion of arbitrary search-term records and their associated search history.

Successful exploitation allows an attacker to delete arbitrary search-term records and all associated search-history rows from the plugin's data. This impacts data integrity and availability of search analytics information. The vulnerability requires tricking a user with administrative access to the plugin's dashboard to perform the malicious action. There is no direct confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into the WordPress dashboard with access to the Search Analytics plugin. Monitoring for updates from the vendor is recommended.