PT-2024-15411 · WordPress · Analytics Insights For Google Analytics 4

Krzysztof Zając · Published 2024-02-12 · Updated 2025-03-26 · CVE-2024-0250

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin versions prior to 6.3

Description The issue is related to insufficient validation on the redirect oauth2callback.php file, which makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. This is due to an Open Redirect vulnerability.

Recommendations For versions prior to 6.3, update to version 6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the oauth2callback.php file to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-0250

Affected Products

Analytics Insights For Google Analytics 4

References · 7

• 🔥 https://wpscan.com/vulnerability/321b07d1-692f-48e9-a8e5-a15b38efa979 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-0250 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0250 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1757097437200576813 · Twitter Post
• https://t.me/cvenotify/116429 · Telegram Post
• https://t.me/cvenotify/97595 · Telegram Post
• https://twitter.com/CVEnew/status/1757077029659484633 · Twitter Post