CVE-2026-9014

Description

The WP Promoter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_stats() function in versions up to, and including, 1.3. The function is hooked to both the wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats actions and contains no authentication, authorization, or nonce validation. This makes it possible for unauthenticated attackers to reset the plugin's bar and popup statistics by deleting the wpp_bar and wpp_popup options.

PUBLISHED Reserved 2026-05-19 | Published 2026-05-27 | Updated 2026-05-27 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

Muhammad Nur Ibnu Hubab finder

References

www.wordfence.com/...-5323-44b9-b980-5619f2db2944?source=cve

plugins.trac.wordpress.org/...ags/1.3/inc/class-wpp-ajax.php

plugins.trac.wordpress.org/...ags/1.3/inc/class-wpp-ajax.php

cve.org (CVE-2026-9014)

nvd.nist.gov (CVE-2026-9014)

Download JSON