The vulnerability is a missing authorization flaw that permits unauthorized parties to modify settings within the WordPress Advanced WC Analytics plugin. This flaw enables privileged actions such as changing analytics configuration, potentially leading to incorrect data collection or exposing sensitive information. The weakness is identified as CWE-862 (Missing Authorization) and directly undermines the integrity of the plugin’s configuration data.

The affected product is Passionate Brains' Advanced WC Analytics plugin for WordPress. All releases up to and including version 3.19.0 are impacted; later releases are not listed as vulnerable.

The CVSS score of 6.5 indicates a moderate severity vulnerability, while the EPSS score of less than 1 % suggests a very low probability of exploitation at the time of analysis. The plugin is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must either be authenticated to the WordPress admin interface or have exploited credential reuse or a misconfiguration that grants sufficient privileges. Once such access is gained, the attacker can modify plugin settings at will. Due to the limited exploitation window and the absence of a known public exploit, the overall risk remains moderate but should not be ignored.