PT-2026-1586 · WordPress · Sharethis Dashboard For Google Analytics

Ifoundbug · Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-12540

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ShareThis Dashboard for Google Analytics plugin for WordPress versions through 3.2.4

Description The plugin is susceptible to Sensitive Information Exposure. The Google Analytics client ID and client secret are stored in plaintext within the publicly accessible plugin source code. An unauthenticated attacker could potentially create a link to the sharethis.com server. If an administrator, logged into the website and Google Analytics, clicks this link, it could share a Google Analytics authorization token with a malicious website.

Recommendations Update to a version beyond 3.2.4.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-12540

Affected Products

Sharethis Dashboard For Google Analytics

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-12540 · Security Note
• https://twitter.com/CVEnew/status/2008824750961737768 · Twitter Post
• https://plugins.trac.wordpress.org/browser/googleanalytics/trunk/credentials.json?rev=3364575 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6781dcc5-db95-43ca-9042-a3c05414b7e6?source=cve · Note