The vulnerability is a missing authorization flaw that allows an attacker to invoke functionality in the AnalyticsWP plugin that should be limited to privileged users. Because the ACLs are not properly enforced, the functionality is not properly restricted, leading to unauthorized access to plugin features.

All versions of the Solid Plugins AnalyticsWP plugin up to and including 2.0.0 are affected. The vulnerability applies to every deployment that uses these versions without any additional custom restrictions. Any WordPress installation that has the plugin installed and is publicly accessible is at risk.

The CVSS score of 5.3 indicates medium severity, the EPSS score of less than 1% suggests a low likelihood of exploitation, and the plugin is not in the CISA KEV catalog. The vulnerability involves the plugin’s web interfaces, but the exact attack vector is not explicitly stated in the description and thus requires additional analysis.