CVE-2026-7444

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the `process_bulk_action()` function of `MWTSA_Stats_Table`. This makes it possible for unauthenticated attackers to delete arbitrary search-term records, including all associated search-history rows, via a forged request granted they can trick a user with access to the plugin's "Search Analytics" dashboard page (Administrator by default) into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/search-analytics/tags/1.4.16/admin/includes/class.stats-table.php#L112
• https://plugins.trac.wordpress.org/browser/search-analytics/tags/1.4.16/admin/includes/class.stats-table.php#L125
• https://plugins.trac.wordpress.org/browser/search-analytics/tags/1.4.16/admin/includes/class.stats-table.php#L132
• https://plugins.trac.wordpress.org/browser/search-analytics/tags/1.4.16/admin/includes/class.stats.php#L99
• https://plugins.trac.wordpress.org/browser/search-analytics/trunk/admin/includes/class.stats-table.php#L132
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3525420%40search-analytics%2Ftrunk&old=3525419%40search-analytics%2Ftrunk&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/search-analytics/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d62b8380-1679-40d8-a77f-17c583e88d39?source=cve

Published

Aug 5, 2026

Last Modified

Aug 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7435SSCMS v7.4.0 contains a SQL injection vulnerability in the s…8.6
• CVE-2026-7436The WPC Badge Management for WooCommerce plugin for WordPres…6.4
• CVE-2026-7437The AzonPost plugin for WordPress is vulnerable to Reflected…6.1
• CVE-2026-7439AgentFlow's local web API accepts non-JSON content types on …4.8
• CVE-2026-7441The Simple Yearly Archive plugin for WordPress is vulnerable…6.4
• CVE-2026-7443A weakness has been identified in BurtTheCoder mcp-dnstwist …7.3
• CVE-2026-7445A security vulnerability has been detected in ZachHandley ZM…6.3
• CVE-2026-7446A vulnerability was detected in VetCoders mcp-server-semgrep…7.3
• CVE-2026-7447A flaw has been found in SourceCodester Pet Grooming Managem…6.3
• CVE-2026-7448Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-7450A maliciously crafted PAR file, when parsed through Autodesk…5.5
• CVE-2026-7451A maliciously crafted TIF file, when parsed through Autodesk…7.8