A missing authorization flaw in the GA4WP: Google Analytics for WordPress plugin lets an attacker with insufficient privileges alter the plugin’s configuration. This could allow changes to the tracking ID, feature toggles, or the injection of malicious scripts into the analytics stream. The vulnerability is a classic example of improper access control (CWE‑862) that, if exploited, can hijack analytics data, exfiltrate information, or modify site tracking behavior without the site owner’s consent.

The issue affects any WordPress site running Passionate Brains’ GA4WP: Google Analytics for WordPress plugin on version 2.10.0 or earlier. Sites must verify that they are not using any of these versions to avoid exposure.

With a CVSS score of 6.5 the flaw is rated moderate, and the EPSS score of less than 1% indicates a very low expected exploitation rate. The vulnerability is not in the CISA KEV catalog. Exploitation requires that the attacker reach the WordPress administrative interface and bypass incorrect ACL checks on the GA4WP settings page. While an authenticated user with limited rights can trigger the bug, the necessity of such access lowers the immediate risk, yet the flaw should still be treated as a medium‑risk issue until a patch is deployed.