CVE-2026-9014 describes a missing authorization vulnerability (CWE-862) in the WP Promoter plugin for WordPress. The reset_stats() function, hooked to both authenticated and unauthenticated AJAX actions (wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats), lacks any capability checks or nonce validation. This allows unauthenticated attackers to invoke this function and reset the plugin's bar and popup statistics by deleting the wpp_bar and wpp_popup options. The vulnerability affects versions up to and including 1.3. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or official remediation is currently documented.

An unauthenticated attacker can reset the WP Promoter plugin's statistics by deleting stored options, causing loss of integrity of statistical data. There is no impact on confidentiality or availability. The attack requires no privileges and can be performed remotely over the network. While this does not lead to code execution or data disclosure, it can disrupt analytics or reporting relying on these statistics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the AJAX endpoints or disabling the plugin if the statistics reset functionality is not required. Implementing custom authorization checks or nonce validation on the reset_stats() function can mitigate unauthorized access.