The vulnerability in the Analytify WordPress plugin arises from a missing capability check on AJAX functions and nonce leakage, enabling authenticated users with subscriber privileges or higher to retrieve sensitive plugin configuration data. This exposure is due to improper access control and insufficient protection of AJAX endpoints. The issue affects all versions up to and including 5.2.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact.

Authenticated attackers with subscriber-level access or higher can obtain sensitive information related to the plugin's settings. This could potentially aid in further attacks or information gathering but does not directly lead to system compromise or denial of service. The impact is limited to confidentiality and integrity of plugin-specific data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for updates from the plugin vendor. Avoid granting unnecessary privileges to users and consider disabling or replacing the plugin if sensitive data exposure is a concern.