This vulnerability involves a missing authorization check in the WP Visitor Statistics (Real Time Traffic) plugin for WordPress, specifically in the wp-stats-manager functionality. Due to the lack of proper access control enforcement, unauthorized users can access certain plugin functions that should be restricted. The vulnerability affects all versions up to 8.4. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, and impact limited to availability (partial disruption). No patch or vendor advisory is currently provided.

The vulnerability allows attackers to access functionality without proper authorization, potentially leading to denial of service or disruption of availability within the plugin. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's administrative interfaces and monitoring for unusual activity related to WP Visitor Statistics. Avoid exposing the plugin's management endpoints to untrusted users.