CVE-2025-12521
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-31

Last updated on: 2025-11-04

Assigner: Wordfence

Description
The Analytify Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0.3 via the Analytify Tag HTML details. This makes it possible for unauthenticated attackers to extract usernames from source code. While we generally do not assign CVE IDs to username exposure issues, this vendor has specifically requested we consider it a vulnerability.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-31
Last Modified
2025-11-04
Generated
2026-06-16
AI Q&A
2025-11-01
EPSS Evaluated
2026-06-14
NVD
CVE-2025-12521
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
analytify analytify_pro *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in the Analytify Pro WordPress plugin (up to version 7.0.3) allows unauthenticated attackers to extract usernames from the source code via the Analytify Tag HTML details. This is considered a Sensitive Information Exposure issue.

Impact Analysis

This vulnerability can impact you by exposing usernames to unauthenticated attackers, which could potentially be used as a starting point for further attacks such as brute force or social engineering. However, it does not affect integrity or availability, only confidentiality of usernames.

Detection Guidance

This vulnerability can be detected by inspecting the source code of the WordPress site using the Analytify Pro plugin (version 7.0.3 or earlier) for exposed usernames in the Analytify Tag HTML details. You can use commands like `curl -s http://yourwordpresssite.com | grep -i analytify` or `wget -qO- http://yourwordpresssite.com | grep -i username` to fetch and search the page source for exposed usernames related to Analytify. Additionally, manual inspection of the page source in a browser's developer tools for username exposure in the Analytify Tag HTML details can help detect the issue.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Analytify Pro plugin to a version later than 7.0.3 where the issue is fixed. If an update is not immediately available, consider disabling or removing the Analytify Pro plugin until a patch is released to prevent exposure of usernames via the Analytify Tag HTML details.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12521. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart