CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on AJAX functions in combination with nonce leakage in all versions up to, and including, 5.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain certain sensitive information related to plugin settings.
Explanation of Vulnerability in Simple Terms
The Analytify plugin for WordPress contains an exposure of sensitive information vulnerability affecting versions up to 5.2.3. An authenticated user with low privileges can access data they should not be able to view. The vulnerability requires network access and valid WordPress credentials but no additional user interaction. Site administrators should update to a version newer than 5.2.3.
What an attacker can do
Read sensitive data they should not have access to within the plugin.
Potential impact on your site
Authenticated users may view analytics data or plugin settings beyond their intended permission level.
Conditions required to exploit
Valid WordPress user account with low-level privileges; network access to the site.
Key dates
External resources
Related vulnerabilities
