The WP Statistics plugin versions prior to 14.16.10 do not enforce capability checks on some AJAX handlers used for dashboard analytics. Instead, they rely only on a nonce, which is available to all authenticated users regardless of their privilege level. As a result, users with low-level privileges (Subscriber and above) can retrieve sensitive visitor analytics data, leading to an information disclosure vulnerability classified as CWE-200.

The vulnerability allows unauthorized disclosure of visitor analytics data to users with Subscriber-level access or higher. This exposure could lead to privacy concerns or leakage of sensitive site traffic information. There is no indication of impact on integrity or availability.

No official patch or remediation guidance is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider restricting access to the affected AJAX handlers or limiting Subscriber-level user capabilities as a temporary mitigation.