CVE-2026-3570

Published: Mar 21, 2026Modified: Jun 17, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security@wordfence.com (Secondary)

Description

The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0. This is due to missing authentication and capability checks on the configuration reset functionality in the global scope of smarter-analytics.php. This makes it possible for unauthenticated attackers to reset all plugin configuration and delete all per-page/per-post analytics settings via the 'reset' parameter.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://plugins.trac.wordpress.org/browser/smarter-analytics/tags/2.0/smarter-analytics.php#L27

Source: security@wordfence.com

https://plugins.trac.wordpress.org/browser/smarter-analytics/trunk/smarter-analytics.php#L27

Source: security@wordfence.com

https://www.wordfence.com/threat-intel/vulnerabilities/id/06f0d53d-734c-4cc1-902d-bdf4826036bf?source=cve

Source: security@wordfence.com

Timeline

No history available yet.