This vulnerability in the kutsy AJAX Hits Counter + Popular Posts Widget arises from missing authorization checks in the ajax-hits-counter component. It allows attackers with low privileges to bypass access control restrictions, potentially modifying or disrupting functionality. The affected versions include all up to 0.10.210305. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Exploitation of this vulnerability can lead to limited integrity and availability impacts due to unauthorized actions performed by low-privileged attackers. Confidentiality is not affected. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected widget and monitor for unusual activity related to ajax-hits-counter functionality.