WP Statistics Visitor Analytics Exposure via Missing Capability Check

Executive Summary

This vulnerability affects the WP Statistics WordPress plugin versions before 14.16.10. It allows authenticated users with Subscriber-level access or higher to access sensitive visitor analytics data due to missing capability checks on certain dashboard analytics AJAX handlers. The plugin only verifies a nonce that all authenticated users have, which is insufficient for proper authorization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WP Statistics plugin version is below 14.16.10. You can use WordPress admin dashboard or run commands like 'wp plugin list' in WP-CLI to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected WP Statistics plugin, an attacker with Subscriber access or higher could view your site's visitor analytics data. This includes sensitive information about site traffic, user behavior, and potentially other tracked metrics, leading to privacy and security risks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if visitor analytics data includes personally identifiable information (PII). Unauthorized access to such data violates privacy regulations, potentially resulting in legal penalties, fines, or reputational damage for organizations handling sensitive user data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the WP Statistics plugin to version 14.16.10 or later to address the capability check issue and prevent unauthorized access to visitor analytics data.

Useful 0 Not Useful 0