The vulnerability identified as CVE-2026-22517 affects the GA4WP: Google Analytics for WordPress plugin by Passionate Brains. It is caused by missing authorization checks, which means that certain actions or data may be accessible without proper permission validation. This issue affects all versions up to 2.10.0. The CVSS 3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and impacts on integrity and availability but not confidentiality. No patch or vendor advisory information is available to confirm remediation status.

The vulnerability allows an attacker with low privileges to exploit missing authorization controls, potentially leading to unauthorized modification or disruption of plugin functionality (integrity and availability impacts). Confidential data exposure is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently referenced, users should monitor for updates from Passionate Brains and apply any official fixes once available. Until then, review and tighten access control configurations where possible to reduce risk.