CVE-2026-9014 WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action
Unauthenticated attackers can reset WP Promoter statistics by exploiting a missing authorization check in the reset_stats AJAX action.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9014?
CVE-2026-9014 is a medium-severity missing authorization vulnerability in rahulbhangale WP Promoter, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP Promoter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_stats() function in versions up to, and including, 1.3. The function is hooked to both the wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats actions and contains no authentication, authorization, or nonce validation. This makes it possible for unauthenticated attackers to reset the plugin's bar and popup statistics by deleting the wpp_bar and wpp_popup options.
Weakness: CWE-862
Which versions are affected by CVE-2026-9014?
How do I fix CVE-2026-9014?
No fix has been published for CVE-2026-9014 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-9014 being exploited?
There is no known exploitation of CVE-2026-9014 in the wild and no public exploit code.
Sources
Also known as GHSA-j5qh-rj6w-86m8.