CVE-2026-9014

The WP Promoter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_stats() function in versions up to, and including, 1.3. The function is hooked to both the wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats actions and contains no authentication, authorization, or nonce validation. This makes it possible for unauthenticated attackers to reset the plugin's bar and popup statistics by deleting the wpp_bar and wpp_popup options.

• CWE-862

• https://plugins.trac.wordpress.org/browser/wp-promoter/tags/1.3/inc/class-wpp-ajax.php#L23
• https://plugins.trac.wordpress.org/browser/wp-promoter/tags/1.3/inc/class-wpp-ajax.php#L28
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ce546f2e-5323-44b9-b980-5619f2db2944?source=cve

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9007Improper neutralization of input during web page generation …5.5
• CVE-2026-9008The Page-list plugin for WordPress is vulnerable to Missing …4.3
• CVE-2026-9009The Crawlomatic Multipage Scraper Post Generator plugin for …8.8
• CVE-2026-9010The Boost plugin for WordPress is vulnerable to time-based S…7.5
• CVE-2026-9011The Ditty – Responsive News Tickers, Sliders, and Lists plug…7.5
• CVE-2026-9013The Bogo plugin for WordPress is vulnerable to Sensitive Inf…4.3
• CVE-2026-9015The Equalize Digital Accessibility Checker – WCAG, ADA, EAA …4.3
• CVE-2026-9016The Debug Log Manager – Conveniently Monitor and Inspect Err…5.3
• CVE-2026-9017The NEX-Forms – Ultimate Forms Plugin for WordPress plugin f…5.3
• CVE-2026-9018The Easy Elements for Elementor – Addons & Website Templates…8.8
• CVE-2026-9019The Easy Image Collage plugin for WordPress is vulnerable to…6.4
• CVE-2026-9021The Easy Invoice plugin for WordPress is vulnerable to Missi…5.3