What the vulnerability does
01Description
The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to missing capability checks on the REST API endpoint '/wise-analytics/v1/report'. This makes it possible for unauthenticated attackers to access sensitive analytics data including administrator usernames, login timestamps, visitor tracking information, and business intelligence data via the 'name' parameter granted they can send unauthenticated requests.
Explanation of Vulnerability in Simple Terms
02Summary
Wise Analytics versions 1.1.9 and earlier lack proper authorization checks, allowing unauthenticated attackers to read sensitive information. An attacker can access the application over the network without credentials or user interaction. The vulnerability exposes confidential data but does not allow modification or service disruption. Update to a version newer than 1.1.9.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the application without authentication.
Potential impact on your site
04Site Impact
Confidential data may be exposed to unauthorized parties; integrity and availability are not affected.
Conditions required to exploit
05Prerequisites
Network access to the application; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 24, 2026
CVE published
April 8, 2026
Record updated
