The WP Statistics WordPress plugin before version 14.16.10 fails to verify the user’s role when handling several AJAX requests that return visitor analytics. Because the only check is a nonce that every authenticated user holds, any user with the role of Subscriber or higher can invoke these endpoints and receive detailed analytics data about site visitors. The result is a breach of confidentiality where sensitive usage information is exposed to users that should not have access to it.

Any instance of the WP Statistics plugin on a WordPress site running a version earlier than 14.16.10 is vulnerable. This includes all unsupported releases of the plugin, regardless of the WordPress core version.

The vulnerability requires a valid authenticated session with a Subscriber or higher role, which is commonly granted on WordPress sites. An attacker can simply call the exposed AJAX URLs to obtain analytics data without additional privileges. The CVSS score of 6.5 indicates a medium severity flaw. While this does not allow code execution or other forms of escalation, the disclosure of visitor information can be valuable for targeted phishing, privacy violations, or competitive intelligence. The EPSS score of < 1% indicates a very low likelihood of exploitation, and because it is not listed in the CISA KEV catalog, the risk of publicly known exploitation is also low. No information is provided regarding WordPress core compatibility, so further assessment is needed to determine if the issue is universally applicable.