Smarter Analytics WordPress Plugin Missing Authorization Vulnerability in Settings Reset Functionality

A vulnerability exists in the Smarter Analytics plugin for WordPress, affecting all versions up to and including 2.0. The issue arises from a lack of authentication and capability checks on the configuration reset feature in the global scope of the 'smarter-analytics.php' file. This flaw allows unauthenticated attackers to reset the entire plugin configuration and remove all per-page or per-post analytics settings by using the 'reset' parameter.

Impact

Exploitation of this vulnerability allows for unauthorized users to reset plugin settings and delete analytics data on a per-page or per-post basis.

Reproduction

To reproduce this vulnerability, send a POST request to the WordPress site with the 'reset' parameter set to 'reset'. This request can be made without authentication, and it will trigger the deletion of all plugin configuration and analytics settings for the specified pages or posts.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.