Search Analytics for WP (1.4.16) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/search-analytics-for-wp-1.4.16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 05 Aug 2026 09:16:52 +0000CSRF Vulnerability in Search Analytics for WP Pluginhttps://feed.craftedsignal.io/briefs/2026-08-search-analytics-wp-csrf/Wed, 05 Aug 2026 09:16:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-search-analytics-wp-csrf/The Search Analytics for WP plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in the process_bulk_action function that allows authenticated administrators to be tricked into deleting arbitrary search-term records.The Search Analytics for WP plugin (versions 1.4.16 and earlier) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw originating from insufficient nonce validation in the MWTSA_Stats_Table class. Specifically, the process_bulk_action function lacks the necessary tokens to verify the legitimacy of a request before performing bulk data operations. This flaw allows an attacker to manipulate an authenticated administrator into executing unauthorized commands. By enticing an administrator to interact with a crafted link or malicious web page while they are logged into the WordPress dashboard, an attacker can trigger the bulk deletion of search-term records and associated history data. This vulnerability is significant for organizations relying on the plugin for audit trails or performance analysis, as the impact involves permanent data loss of sensitive search analytics.

Attack Chain

  1. Attacker identifies the target site running Search Analytics for WP <= 1.4.16.
  2. Attacker crafts a malicious URL or HTML page containing a forged request targeting the plugin's bulk action endpoint.
  3. Attacker uses social engineering to lure an administrator of the WordPress site to visit the malicious resource.
  4. The victim's browser, already holding an active administrator session cookie, automatically executes the request to the target WordPress site.
  5. The WordPress server receives the request and, due to the missing nonce check in process_bulk_action, treats it as a legitimate administrative command.
  6. The plugin logic triggers the deletion of requested search-term records.
  7. The target database is updated, resulting in the loss of search-history rows.

Impact

Successful exploitation results in the unauthorized deletion of arbitrary search-term records and all associated history rows stored in the database. This directly impacts data integrity for WordPress sites using the Search Analytics for WP plugin for data-driven insights. While no direct RCE is reported, the loss of historical data can disrupt business operations and eliminate key audit data regarding user interactions on the site.

Recommendation

  • Update the Search Analytics for WP plugin to version 1.4.17 or higher once the security patch is released by the developer.
  • Audit web access logs for suspicious administrative activity originating from unexpected referrers that deviate from normal site usage patterns.
  • Monitor administrative accounts to ensure that they are not using shared or insecure browsing environments while accessing the site backend.
]]>highadvisoryweb-application-vulnerabilitywordpresscsrf