CVE-2025-12540

Katalog CVE

CVSS 4.7 · Medium EPSS 0,28%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor. Skor CVSS 3.1 4.7 (Medium) menurut wordfence.com.

Deskripsi (NVD)

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Google Analytics client_ID and client_secret being stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to craft a link to the sharethis.com server, which will share an authorization token for Google Analytics with a malicious website, if the attacker can trick an administrator logged into the website and Google Analytics to click the link.

Rincian

Terbit di NVD

7 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

4.7 (Medium), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/browser/googleanalytics/trunk/credentials.json?rev=3364575
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6781dcc5-db95-43ca-9042-a3c05414b7e6?source=cve