CVE-2025-14609 describes a missing authorization vulnerability in the Wise Analytics plugin for WordPress, affecting all versions up to 1.1.9. The issue arises from the lack of capability checks on the REST API endpoint '/wise-analytics/v1/report', which permits unauthenticated access to sensitive analytics data. This includes administrator usernames, login timestamps, visitor tracking, and business intelligence information. The vulnerability has a medium severity rating with a CVSS score of 5.3 and is identified as CWE-862. There is no indication of an official patch or vendor advisory addressing this issue at this time.

An unauthenticated attacker can retrieve sensitive analytics data from the affected WordPress plugin, potentially exposing administrator usernames, login timestamps, visitor tracking details, and business intelligence data. This exposure could aid attackers in reconnaissance but does not directly allow system compromise or data modification according to the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Wise Analytics plugin or restricting access to the REST API endpoint '/wise-analytics/v1/report' via web server or firewall rules to prevent unauthenticated access.