CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the login() function in all versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to update the email associated through the plugin with GA4.
Explanation of Vulnerability in Simple Terms
The HT Easy GA4 plugin for WordPress does not properly check user permissions before allowing modifications to Google Analytics settings. An unauthenticated attacker can change the plugin's configuration, such as the Google Analytics tracking ID or data collection settings, without logging in. This could redirect analytics data to an attacker's account or disable tracking entirely.
What an attacker can do
Modify the plugin's Google Analytics configuration without authentication.
Potential impact on your site
Analytics data could be redirected to an attacker's account or tracking disabled, compromising data integrity.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
