CVE-2025-12521
BaseFortify
Publication date: 2025-10-31
Last updated on: 2025-11-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| analytify | analytify_pro | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Analytify Pro WordPress plugin (up to version 7.0.3) allows unauthenticated attackers to extract usernames from the source code via the Analytify Tag HTML details. This is considered a Sensitive Information Exposure issue.
How can this vulnerability impact me? :
This vulnerability can impact you by exposing usernames to unauthenticated attackers, which could potentially be used as a starting point for further attacks such as brute force or social engineering. However, it does not affect integrity or availability, only confidentiality of usernames.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting the source code of the WordPress site using the Analytify Pro plugin (version 7.0.3 or earlier) for exposed usernames in the Analytify Tag HTML details. You can use commands like `curl -s http://yourwordpresssite.com | grep -i analytify` or `wget -qO- http://yourwordpresssite.com | grep -i username` to fetch and search the page source for exposed usernames related to Analytify. Additionally, manual inspection of the page source in a browser's developer tools for username exposure in the Analytify Tag HTML details can help detect the issue.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the Analytify Pro plugin to a version later than 7.0.3 where the issue is fixed. If an update is not immediately available, consider disabling or removing the Analytify Pro plugin until a patch is released to prevent exposure of usernames via the Analytify Tag HTML details.