PT-2026-1586 · WordPress · Sharethis Dashboard For Google Analytics

Ifoundbug · Publicado 2026-01-07 · Atualizado 2026-01-07 · CVE-2025-12540

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ShareThis Dashboard for Google Analytics plugin for WordPress versions through 3.2.4

Description The plugin is susceptible to Sensitive Information Exposure. The Google Analytics client ID and client secret are stored in plaintext within the publicly accessible plugin source code. An unauthenticated attacker could potentially create a link to the sharethis.com server. If an administrator, logged into the website and Google Analytics, clicks this link, it could share a Google Analytics authorization token with a malicious website.

Recommendations Update to a version beyond 3.2.4.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-12540

Produtos afetados

Sharethis Dashboard For Google Analytics

Referências · 4

• https://twitter.com/CVEnew/status/2008824750961737768 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/googleanalytics/trunk/credentials.json?rev=3364575 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12540 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/6781dcc5-db95-43ca-9042-a3c05414b7e6?source=cve · Nota