WordPress users of WP Visitor Statistics (Real Time Traffic) may be able to bypass authorization and view usage statistics that belong to other users or the entire site, leading to potential exposure of sensitive traffic analytics. The vulnerability arises from a missing authorization check that allows improper access control in the wp-stats-manager plugin.

The plugin is affected across all installations of WP Visitor Statistics (Real Time Traffic) with versions from the first release through 7.5 inclusive. Users running any of these versions, regardless of WordPress site configuration, are vulnerable.

The CVSS score of 4.3 classifies the issue as moderate severity, while an EPSS under 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV, further suggesting limited real-world exploitation risk. However, attackers could target sites that rely on detailed visitor statistics and may gain insights into site traffic patterns if they can authenticate to the administration interface or otherwise exploit the plugin’s incorrect access control logic.