CVE-2024-1584: Analytify <= 5.2.1 - Missing Authorization to Unauthenticated Google Analytics Tracking ID Modification
The Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpacheckauthentication' function in all versions up to, and including, 5.2.1. This makes it possible for unauthenticated attackers to modify the site's Google Analytics tracking ID.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1584?
CVE-2024-1584 is considered a high severity vulnerability due to the potential for unauthorized modification of data.
How do I fix CVE-2024-1584?
To fix CVE-2024-1584, update the Analytify – Google Analytics Dashboard for WordPress plugin to version 5.2.2 or later.
What impact does CVE-2024-1584 have on website security?
CVE-2024-1584 can allow an attacker to manipulate Google Analytics data, undermining the integrity of analytics reporting.
Which versions of the Analytify plugin are affected by CVE-2024-1584?
CVE-2024-1584 affects all versions of the Analytify plugin for WordPress up to and including version 5.2.1.
Are there any known exploits for CVE-2024-1584?
Yes, there may be known exploits that take advantage of the missing capability check in CVE-2024-1584, emphasizing the need for immediate updates.