The WP Statistics plugin for WordPress versions prior to 14.16.10 contains a vulnerability where dashboard analytics AJAX handlers do not enforce capability checks. Instead, they rely only on a nonce, which is available to all authenticated users, including those with Subscriber-level access. This flaw enables these users to retrieve visitor analytics data that should be restricted, resulting in an information disclosure issue classified under CWE-200.

Users with Subscriber-level access or higher can access sensitive visitor analytics data that should be restricted to higher privilege roles. This exposure could lead to privacy concerns or leakage of site traffic information. There is no indication of further privilege escalation or remote code execution from this vulnerability.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, site administrators should consider restricting Subscriber-level access or monitoring plugin updates closely.