The WP Statistics plugin for WordPress suffers from a missing capability check in the 'optionUpdater' function, classified as CWE-862 (Missing Authorization). This flaw allows authenticated users with low privileges (Subscriber and above) to update arbitrary plugin settings, potentially altering analytics data or behavior. The vulnerability is present in all versions up to 14.13.3. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and low privileges required.

An attacker with Subscriber-level access or higher can modify plugin settings without proper authorization, potentially impacting the integrity and reliability of analytics data collected by the plugin. There is no indication of impact on confidentiality or availability beyond the integrity of plugin settings. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber or higher privileges to untrusted users.