This vulnerability in GA4WP: Google Analytics for WordPress is due to missing authorization checks, leading to incorrect access control. It affects all versions up to 2.10.0. The vulnerability allows an attacker to exploit the lack of proper authorization, potentially gaining unauthorized access to plugin functionality. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, impacting confidentiality and availability to a limited extent. No patch or official remediation guidance is currently provided by the vendor or in public advisories.

The vulnerability could allow unauthorized remote attackers to access or interact with parts of the plugin that should be restricted, leading to limited confidentiality loss and partial availability impact. There is no indication of integrity impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the plugin's administrative interfaces and monitor for updates from Passionate Brains. No official fix or temporary workaround is currently documented.