The WP Statistics plugin before version 14.16.10 contains a privilege escalation flaw in its AJAX handlers. All affected endpoints call check_ajax_referer() — which verifies the request originated from an authenticated session — but never call current_user_can() to verify the user actually has permission to access the data being requested. This is the critical distinction: nonce verification proves who made the request, not whether they should see the response. As a result, any user with Subscriber-level access (the lowest privilege tier, which WordPress allows anyone to register for on most sites) can retrieve sensitive analytics data including traffic volumes, geographic distributions, referral sources, and temporal访问 patterns. This transforms a low-privilege account into reconnaissance infrastructure for targeted attacks.
This is not a novel vulnerability class. The WordPress ecosystem has documented this exact flaw — AJAX handlers protected by nonce alone without capability checks — across dozens of plugins since at least 2019. The pattern persists because the standard wpajax* documentation emphasizes nonce verification as the security measure, while the authorization function current_user_can() requires a separate, independent call that developers must proactively remember to add. The fix in WP Statistics 14.16.10 adds current_user_can('manage_options') checks to the affected handlers.
If you maintain WordPress sites running WP Statistics, update to 14.16.10 immediately. If you're developing WordPress plugins, audit every AJAX handler: after verifying the nonce, explicitly check that the current user has the required capability before returning any data. Treat nonce-only protection as incomplete — it's authentication without authorization. For security teams scanning WordPress deployments, grep for add_action('wpajax.*') followed by check_ajax_referer() and verify a current_user_can() call follows before any sensitive output.