The WP Statistics plugin contains missing capability checks in several AJAX handlers. The handlers validate only a wp_rest nonce and do not verify that the user has sufficient privileges. As a result, authenticated users with Subscriber-level access and higher can retrieve user identifiers, usernames, emails, visitor tracking data, modify privacy audit compliance status, and dismiss administrative notices. This flaw exposes confidential personal data and allows attackers to tamper with audit records, compromising both confidentiality and integrity of user information. The weakness is a classic authorization failure (CWE‑862).

WordPress sites running the WP Statistics plugin version 14.16.4 or earlier, released by veronalabs under the name “WP Statistics – Simple, privacy-friendly Google Analytics alternative.” All such sites are affected regardless of the WordPress version, as the flaw resides in the plugin's AJAX handlers.

The CVSS v3 score is 6.5, indicating a medium severity vulnerability. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access; any user with Subscriber or higher role can exploit the flaw, making exploitation highly probable on any site with the plugin installed and enabled. With the current checks absent, attackers can harvest sensitive analytics data and alter privacy settings, resulting in a moderate but real risk to user privacy.