{"id":"CVE-2026-7444","published":"2026-08-05T08:16:44.400","lastModified":"2026-08-05T14:17:14.840","description":"The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the `process_bulk_action()` function of `MWTSA_Stats_Table`. This makes it possible for unauthenticated attackers to delete arbitrary search-term records, including all associated search-history rows, via a forged request granted they can trick a user with access to the plugin's \"Search Analytics\" dashboard page (Administrator by default) into performing an action such as clicking on a link.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/search-analytics/tags/1.4.16/admin/includes/class.stats-table.php#L112","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/search-analytics/tags/1.4.16/admin/includes/class.stats-table.php#L125","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/search-analytics/tags/1.4.16/admin/includes/class.stats-table.php#L132","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/search-analytics/tags/1.4.16/admin/includes/class.stats.php#L99","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/search-analytics/trunk/admin/includes/class.stats-table.php#L132","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3525420%40search-analytics%2Ftrunk&old=3525419%40search-analytics%2Ftrunk&sfp_email=&sfph_mail=","tags":[]},{"url":"https://wordpress.org/plugins/search-analytics/","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d62b8380-1679-40d8-a77f-17c583e88d39?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthenticated attackers to delete search-term records via a Cross-Site Request Forgery attack, compromising user data.","exploitability":"Exploitation requires tricking an administrator into performing an action, making it moderately hard but feasible with social engineering.","blast_radius":"If exploited, the impact could be significant as it allows deletion of all associated search-history rows for any user.","remediation":"Update to the latest version of Search Analytics for WP plugin immediately or disable the feature until patched.","tags":["csrf","data-loss","wp-plugin","unauthenticated"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:50:22.114Z"}}