Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-97343 · Microsoft / collected KEV context

cve-program · CVE-2026-97343

• https://www.wordfence.com/threat-intel/vulnerabilities/id/0aab68b4-fd5a-4471-bd29-a1a6dbfcf4ec?source=cve
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/Admin/Share/Services/class-share-ui.php#L124
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/Admin/Share/Services/class-share-tokens.php#L506
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/Admin/Share/class-share.php#L69
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.1/includes/class-burst.php#L105
• https://github.com/Burst-Statistics/burst-statistics
• https://plugins.trac.wordpress.org/browser/burst-statistics/tags/3.7.2/includes/Admin/Share/Services/class-share-tokens.php

No related operational record is retained in the current change model.