VDB

CVE-2024-1809

CVE-2024-1809 PUBLISHED CVSS 5.400000095367432 MEDIUM

The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on AJAX functions in combination with nonce leakage in all versions up to, and including, 5.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain certain sensitive information related to plugin settings.

EPSS 0.29% · 21.9th percentile

Risk Scores

CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score
0.29%
21.9th percentile

Affected Products

VendorProductVersions
analytifyanalytify_-_google_analytics_dashboard0, 0
hiddenpearlsAnalytify – Google Analytics Dashboard For WordPress (GA4 analytics tracking)0
hiddenpearlsAnalytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy)*

Timeline

  • May 2, 2024 CVE Published
  • May 3, 2024 EPSS Score
  • May 27, 2024 EPSS Score
  • Jun 21, 2024 EPSS Score
  • Jul 15, 2024 EPSS Score
  • Sep 6, 2024 EPSS Score
  • Oct 1, 2024 EPSS Score
  • Oct 4, 2024 Coalition ESS Score
  • Oct 25, 2024 EPSS Score
  • Nov 19, 2024 EPSS Score
  • Dec 14, 2024 EPSS Score
  • Jan 8, 2025 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›