CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionUpdater' function in all versions up to, and including, 14.13.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin settings.
Explanation of Vulnerability in Simple Terms
WP Statistics contains an authorization flaw that allows authenticated users with low privileges to read and modify data they should not access. The vulnerability affects versions up to 14.13.3. An attacker with a basic user account can view or alter statistics and configuration information without proper permission checks. Site administrators should update to a version newer than 14.13.3.
What an attacker can do
Read and modify WP Statistics data and settings without proper authorization.
Potential impact on your site
Unauthorized users can access and alter your site's analytics data and plugin configuration.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the WordPress site.
Key dates
External resources
Related vulnerabilities
