Vulnerability through /wp-json/wp-statistics/v2/online

Hi @behroozjanfada,

Thank you for opening the thread and sharing your concerns.

I have escalated this to our team for further review and investigation. I will get back to you as soon as we have an update.

Thank you for your patience and understanding!

— Matthew

Dear @behroozjanfada,

We’re working on adding timestamp validation to incoming requests to help prevent repeated calls and protect against potential abuse or attacks.

This enhancement is expected to be in place within 1–2 weeks, and I’ll keep you updated once it’s live.

In the meantime, I recommend switching to Server-Side Tracking and restricting access to the WP REST API for WP Statistics. You can do this by adding the following code snippet to your active theme’s functions.php file:

add_filter('rest_endpoints', function ($endpoints) {
    if (isset($endpoints['/wp-statistics/v2'])) {
        unset($endpoints['/wp-statistics/v2']);
    }
    foreach ($endpoints as $route => $details) {
        if (strpos($route, '/wp-statistics/v2') === 0) {
            unset($endpoints[$route]);
        }
    }

    return $endpoints;
});

This will disable access to all REST API routes under the wp-statistics/v2 namespace, helping to reduce unwanted or repeated requests.

— Matthew

Hi @behroozjanfada,

I’m pleased to inform you that we’ve released version 14.13.2. This update includes the implementation of timestamp validation for incoming requests.

Please update to the latest version and enjoy the improvements!

— Matthew