The WordPress Analytify plugin has a missing authorization flaw that permits a user to modify its settings without the proper privilege. Labeled as CWE‑862, the vulnerability allows an authenticated user to change analytics configuration, potentially leading to incorrect tracking or exposing private information through misconfigured reports.

The flaw affects the Adnan:Analytify WordPress plugin across all releases up to and including version 5.5.1. No specific sub‑minor versions are indicated beyond the <=5.5.1 boundary.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to be authenticated to the WordPress site but does not require elevated privileges; they can then access the plugin’s settings page and alter its configuration, making this a relatively low‑barrier, locally or remotely authenticated attack.