CVE-2025-3953

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3953", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-25T23:58:05.738Z", "datePublished": "2025-04-30T05:23:09.097Z", "dateUpdated": "2026-04-08T16:34:06.489Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:06.489Z"}, "affected": [{"vendor": "veronalabs", "product": "WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "14.13.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Statistics \u2013 The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionUpdater' function in all versions up to, and including, 14.13.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin settings."}], "title": "WP Statistics \u2013 The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/07f7ef07-0f14-4b74-8d47-d5dece4954b0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.13.2/src/Service/Admin/AjaxOptionUpdater.php#L33"}, {"url": "https://plugins.trac.wordpress.org/changeset/3283791/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"}], "timeline": [{"time": "2026-03-27T10:57:16.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-04-29T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-30T13:06:20.439617Z", "id": "CVE-2025-3953", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-30T13:06:49.615Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3953", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-30T13:06:20.439617Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-30T13:06:45.628Z"}}], "cna": {"title": "WP Statistics \u2013 The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update", "credits": [{"lang": "en", "type": "finder", "value": "Tr\u01b0\u01a1ng H\u1eefu Ph\u00fac (truonghuuphuc)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "veronalabs", "product": "WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "14.13.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-27T10:57:16.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-04-29T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/07f7ef07-0f14-4b74-8d47-d5dece4954b0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.13.2/src/Service/Admin/AjaxOptionUpdater.php#L33"}, {"url": "https://plugins.trac.wordpress.org/changeset/3283791/"}], "descriptions": [{"lang": "en", "value": "The WP Statistics \u2013 The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionUpdater' function in all versions up to, and including, 14.13.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin settings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:06.489Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3953", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:34:06.489Z", "dateReserved": "2025-04-25T23:58:05.738Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-30T05:23:09.097Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative", "vendor": "veronalabs", "versions": [{"lessThanOrEqual": "14.13.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Statistics \u2013 The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionUpdater' function in all versions up to, and including, 14.13.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin settings."}, {"lang": "es", "value": "El complemento WP Statistics \u2013 The Most Popular Privacy-Friendly Analytics Plugin para WordPress, es vulnerable a la modificaci\u00f3n no autorizada de datos debido a la falta de comprobaci\u00f3n de la funci\u00f3n \"optionUpdater\" en todas las versiones hasta la 14.13.3 incluida. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, actualicen la configuraci\u00f3n arbitraria del complemento."}], "id": "CVE-2025-3953", "lastModified": "2026-06-17T09:20:59.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3953", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-30T13:06:20.439617Z", "version": "2.0.3"}}]}, "published": "2025-04-30T06:15:53.300", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.13.2/src/Service/Admin/AjaxOptionUpdater.php#L33"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3283791/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/07f7ef07-0f14-4b74-8d47-d5dece4954b0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T02:07:04.159684+00:00", "value": {"mitigation_remediation": ["Upgrade WP Statistics to version 14.13.4 or later to receive the missing capability check fix.", "Ensure that only trusted roles such as Administrator have Subscriber level or higher access; consider using role\u2011management plugins to limit permissions.", "If an upgrade is not immediately possible, restrict the AjaxOptionUpdater endpoint to Administrators by applying a temporary role filter or disabling the endpoint until a patch can be applied."], "summary": {"action": "Apply Patch", "impact": "Arbitrary Plugin Settings Update"}, "threat_synthesis": {"affected_systems": "Veronalabs\u2019 WP Statistics \u2013 Simple, privacy\u2011friendly Google Analytics alternative is affected in all releases up to and including 14.13.3. Users running any of those versions on WordPress sites are vulnerable, regardless of custom configuration or theme.", "description_and_impact": "The flaw is a missing capability check in the optionUpdater function of the WP Statistics plugin, which allows an authenticated user with Subscriber level access or higher to modify any plugin setting. This missing authorization (CWE-862) can alter tracking behavior, data collection, or privacy configurations, thereby compromising the intended privacy\u2011friendly functionality of the plugin and potentially exposing sensitive analytics data.", "risk_and_exploitability": "The CVSS score of 5.4 classifies this vulnerability as medium severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated WordPress user with at least Subscriber privileges; an attacker must log in to a site, then exploit the exposed Ajax endpoint to change plugin settings. Without elevated system privileges or broader access, an attacker cannot trigger the flaw remotely."}}}}, "created": "2026-04-28T02:15:18.701726+00:00", "updated": "2026-04-28T02:15:18.701737+00:00", "vendors": []}