rootpwn

medium · CVSS v3 5.3 · CVSS v4 6.9

CVE-2026-93984

The OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to cryptographically verify client secrets prior to

Overview

The OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to cryptographically verify client secrets prior to authorizing revenue events and bot filtering. Attackers possessing only a public client ID can supply arbitrary dummy values to inject forged revenue metrics and bypass bot detection mechanisms. This integrity failure compromises analytics reliability and may skew business intelligence data.

Description

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

Impact

Integrity impact is moderate as unauthorized actors can manipulate revenue metrics and bypass bot filtering controls, leading to corrupted analytics data. Confidentiality and availability remain unaffected. Website administrators and businesses relying on accurate traffic and revenue reporting are impacted.

Remediation

Apply the latest vendor patches or updates beyond commit bad75bddc74d12d36cfb843f4531d3b830a8d994. Ensure the tracking API correctly validates cryptographic client secret hashes before processing revenue and bot filtering events. Monitor analytics platforms for sudden, unexplained anomalies in revenue metrics or traffic volumes.

Risk context

The vulnerability holds a medium severity with a CVSS v3 score of 5.3 and a CVSS v4 score of 6.9, indicating moderate risk. No EPSS data is currently available, suggesting limited active exploitation metrics in the wild. Defenders should prioritize remediation as part of standard update cycles to protect analytics integrity.

Affected products

  • OpenPanel OpenPanel

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
6.9
EPSS
—

API Authentication Cryptographic Verification Data Integrity OpenPanel Analytics

← All CVEs

Related CVEs

medium

CVE-2026-89333

The Tutor LMS plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in versions up to and including 4.0.8. The flaw exists due to missing validation on the 'student_id' parameter. This allows authenticated attackers with subscriber-level access to harvest sensitive user information, including emails and phone numbers, by iterating through user IDs.

View analysis

medium

CVE-2026-89334

An authorization bypass vulnerability exists in the Better Messages WordPress plugin up to version 2.15.33 due to improper privilege verification. The flaw allows authenticated users with custom-level access or higher to read unauthorized chat transcripts, thread metadata, and user data. This occurs when specific default chat room settings remain unconfigured.

View analysis

medium

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before version 28.2 fails to validate conversation ownership during unauthenticated AI booking-assistant actions. This flaw allows unauthenticated visitors to read and inject messages into other users' active conversations. It matters because it exposes private communications within the scheduling interface.

View analysis

medium

CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 allows unauthenticated users to publish arbitrary GraphQL queries and claim aliases without authorization. This flaw lets attackers inject or modify persisted queries that the site’s frontend will later execute. It can lead to data leakage, query tampering, or denial of service.

View analysis