Vulnerability

According to Wordfence

The Visitors Traffic Real Time Statistics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 7.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to view visitor statistics.

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/visitors-traffic-real-time-statistics/visitors-traffic-real-time-statistics-72-missing-authorization-via-multiple-ajax-actions