CVE-2024-1809: analytify analytify_-_google_analytics_dashboard Missing Authorization
Vulnerability summary
CVE-2024-1809 is a medium (CVSS 5.4) Missing Authorization vulnerability in analytify analytify_-_google_analytics_dashboard. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.3% of scored vulnerabilities. Fixed in 5.2.4.
Timeline
- 02-05-2024PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on AJAX functions in combination with nonce leakage in all versions up to, and including, 5.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain certain sensitive information related to plugin settings.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- wordfenceSource5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
0.00 pp
From 0.29% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereThe product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
Affected systems
Analytify1 product
Hiddenpearls1 product
Wordpress1 product
- wp-analytify≤ 5.2.3 (fixed in 5.2.4)
3 vendors · 3 products