Wise Analytics <= 1.1.9 - Missing Authorization to Unauthenticated Arbitrary Analytics Database Disclosure via 'name' Parameter
mediumThe Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to missing capability checks on the REST API endpoint '/wise-analytics/v1/report'. This makes it possible for unauthenticated attackers to access sensitive analytics data including adm...
- CVSS:
- 5.3
- Affected:
- up to 1.1.9
- Fixed in:
- 1.1.20
- Disclosed:
- Jan 23, 2026