Attack Vectors

CVE-2025-49996 is a Medium-severity missing authorization issue (CVSS 5.3) affecting the WP Visitor Statistics (Real Time Traffic) plugin (slug: wp-stats-manager) in versions up to and including 8.4.

Because the weakness is reachable without authentication, an external attacker does not need a valid WordPress account to attempt exploitation. In practical terms, this means the attack can originate from anywhere on the internet and can be carried out at scale (e.g., via automated scans that look for vulnerable plugin versions).

Reference: CVE-2025-49996.

Security Weakness

The root cause is a missing capability (authorization) check on a plugin function in WP Visitor Statistics (Real Time Traffic) <= 8.4. In WordPress terms, capability checks help ensure only approved roles (or administrators) can perform sensitive actions.

When these checks are absent, WordPress cannot reliably enforce who is allowed to execute the affected function. According to the advisory, this can allow unauthenticated attackers to perform an unauthorized action, even though they should not have access.

Source: Wordfence vulnerability record.

Technical or Business Impacts

Even at Medium severity, missing authorization vulnerabilities can create meaningful business risk because they undermine basic access control. If exploited, the impact depends on what the affected function does, but the overall risk is that an external party can trigger actions your organization did not approve.

From a business perspective, this can translate into operational disruption (unexpected site behavior), increased time and cost for incident response, and potential compliance concerns if unauthorized actions affect data integrity or required controls. For marketing and revenue teams, the biggest downstream risk is loss of trust and the knock-on effects of site instability during campaigns, launches, or high-traffic periods.

Remediation: Update WP Visitor Statistics (Real Time Traffic) to version 8.5 or newer (patched). After updating, validate that the site is functioning normally and review any recent unusual activity around the plugin’s usage.

Similar Attacks

Missing authorization or permission-check issues have repeatedly been used to take unauthorized actions on WordPress sites—sometimes at very large scale. Examples include:

WordPress 4.7.2 Security Release (REST API content injection fix)
WPScan: WP GDPR Compliance (CVE-2018-19207) – unauthenticated options change/admin takeover class issue