Unauthorized Data Access in Analytify Plugin for WordPress

CVE-2024-1809

What is CVE-2024-1809?

The Analytify – Google Analytics Dashboard for WordPress allows unauthorized access to sensitive data due to a missing capability check on AJAX functions. This issue, combined with nonce leakage, affects all versions up to and including 5.2.3, enabling authenticated users with subscriber access or higher to retrieve sensitive plugin settings, posing a significant risk to user data.

References