The vulnerability CVE-2025-28962 affects the Advanced Google Universal Analytics plugin by stefanoai, specifically versions up to 1.0.3. It is caused by missing authorization checks due to incorrectly configured access control security levels. This allows users with low privileges (PR:L) to access functionality without proper authorization, potentially leading to unauthorized data exposure or actions. The vulnerability does not require user interaction (UI:N) and impacts confidentiality (C:H) but not integrity or availability. The attack vector is network-based (AV:N). No patch or vendor advisory is currently available.

The vulnerability allows an attacker with limited privileges to bypass authorization controls, potentially exposing sensitive data handled by the plugin. The CVSS score reflects a medium severity impact primarily on confidentiality. There is no evidence of integrity or availability impact. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, users should monitor vendor communications for updates. Until a fix is released, restricting access to trusted users and minimizing privileges may reduce risk.