CVE-2024-53814 MEDIUM

CVE-2024-53814: WordPress Analytify plugin <= 5.4.3 - Broken Access Control vulnerability

Vendor Adnan

Product Analytify

Weakness CWE-497

Published December 9, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Adnan Analytify wp-analytify.This issue affects Analytify: from n/a through <= 5.4.3.

Explanation of Vulnerability in Simple Terms

02Summary

Analytify versions up to 5.4.3 expose sensitive information to authenticated users. A logged-in attacker with low privileges can read data they should not have access to. The vulnerability does not allow modification or deletion of data, and requires an active user account on the site.

What an attacker can do

03Attacker Capabilities

Read sensitive data they should not have access to.

Potential impact on your site

04Site Impact

User data may be exposed to authenticated attackers with basic site access.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account and be logged in.

Key dates

06Disclosure timeline

December 9, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-53814 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/497.html AskarLabs — CWE-497 write-up Exposure of Sensitive System Information to an Unauthorized Control Sphere

Related vulnerabilities