Skip to main content

Analytify Google Analytics Dashboard CVE-2024-1809

MEDIUM
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)
2024-05-02 security@wordfence.com
Authentication Bypass Google WordPress Analytify Google Analytics Dashboard
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Patch released
Apr 08, 2026 - 18:22 nvd
Patch available
CVE Published
May 02, 2024 - 17:15 nvd
MEDIUM 5.4

DescriptionCVE.org

The Analytify - Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on AJAX functions in combination with nonce leakage in all versions up to, and including, 5.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain certain sensitive information related to plugin settings.

AnalysisAI

The Analytify - Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on AJAX. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-497. The Analytify - Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on AJAX functions in combination with nonce leakage in all versions up to, and including, 5.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain certain sensitive information related to plugin settings. Affected products include: Analytify Analytify - Google Analytics Dashboard.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Analytify Google Analytics Dashboard

View all
CVE-2024-35689 HIGH
8.8 Jun 08

Cross-Site Request Forgery (CSRF) vulnerability in Analytify.2.3. Rated high severity (CVSS 8.8), this vulnerability is

CVE-2022-38137 HIGH
8.8 Nov 08

Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress. Rated high severity (CVSS 8.8
CVE-2022-45830 MEDIUM
6.5 Jan 02

Missing Authorization vulnerability in Analytify.2.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely e
CVE-2024-1584 MEDIUM
5.3 May 02

The Analytify - Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to
CVE-2024-43265 LOW
3.5 Aug 26

Cross-Site Request Forgery (CSRF) vulnerability in Analytify.3.1. Rated low severity (CVSS 3.5), this vulnerability is r

Same weakness CWE-497 – Exposure of Sensitive System Information to an Unauthorized Control Sphere

View all
CVE-2026-34413 HIGH POC
8.8
CVE-2026-41459 MEDIUM POC
6.9
CVE-2022-1902 HIGH POC
8.8
CVE-2022-4985 HIGH POC
8.7
CVE-2018-25358 HIGH POC
8.7
CVE-2020-36922 HIGH POC
7.5
CVE-2020-36926 HIGH POC
7.5
CVE-2024-25634 MEDIUM POC
6.5

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-1809 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy