CVE-2026-7444 is a CSRF vulnerability in the Search Analytics for WP plugin for WordPress affecting all versions up to and including 1.4.16. The issue is due to missing or incorrect nonce validation in the process_bulk_action() function within the MWTSA_Stats_Table class. This allows an unauthenticated attacker to craft a forged request that, when executed by a user with administrative access to the plugin's dashboard, can delete arbitrary search-term records and related search history. The vulnerability has a CVSS 3.1 score of 8.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

Successful exploitation allows an attacker to delete arbitrary search-term records and all associated search-history rows from the plugin's data store. This results in data integrity and availability loss for the affected plugin's analytics data. There is no confidentiality impact reported. The attack requires tricking an authenticated user with access to the plugin's dashboard to perform the malicious action.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into the WordPress dashboard with access to the Search Analytics plugin. Monitoring for plugin updates and applying them promptly when released is recommended.