Vulnerability · Published Mar 21, 2026 · Assigned by Wordfence
CVE-2026-3570Smarter Analytics <= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter
Medium 5.3
In plain English
A medium-severity missing authorization in Smarter Analytics from acumenconsulting. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0. This is due to missing authentication and capability checks on the configuration reset functionality in the global scope of smarter-analytics.php. This makes it possible for unauthenticated attackers to reset all plugin configuration and delete all per-page/per-post analytics settings via the 'reset' parameter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| acumenconsulting | Smarter Analytics | 0 – through 2.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N