CVE-2025-26773
Published: 17 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-26773 is a missing authorization vulnerability, mapped to CWE-862, in the Analytify WordPress plugin (wp-analytify) from Adnan Analytify. The issue enables exploitation of incorrectly configured access control security levels and affects the plugin from unspecified initial versions through 5.5.0.
The vulnerability has a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), indicating exploitation over the network with low complexity and no user interaction. It requires low privileges, such as an authenticated user with basic access, and results in limited unauthorized disclosure of confidential information without impacting integrity or availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-analytify/vulnerability/wordpress-analytify-plugin-5-5-0-broken-access-control-vulnerability?_s_id=cve.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Missing authorization (CWE-862) in a public-facing WordPress plugin directly enables exploitation of public-facing applications over the network with low privileges for unauthorized data disclosure.