CVE-2025-12540

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12540", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-30T23:18:03.695Z", "datePublished": "2026-01-07T08:21:52.708Z", "dateUpdated": "2026-04-08T16:58:14.741Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:14.741Z"}, "affected": [{"vendor": "sharethis", "product": "ShareThis Dashboard for Google Analytics", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Google Analytics client_ID and client_secret being stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to craft a link to the sharethis.com server, which will share an authorization token for Google Analytics with a malicious website, if the attacker can trick an administrator logged into the website and Google Analytics to click the link."}], "title": "ShareThis Dashboard for Google Analytics <= 3.2.4 - Unauthenticated Google Analytics Data Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6781dcc5-db95-43ca-9042-a3c05414b7e6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/googleanalytics/trunk/credentials.json?rev=3364575"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "baseScore": 4.7, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "ifoundbug"}], "timeline": [{"time": "2026-01-06T19:59:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T16:37:31.948911Z", "id": "CVE-2025-12540", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:37:38.984Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12540", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T16:37:31.948911Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:37:34.985Z"}}], "cna": {"title": "ShareThis Dashboard for Google Analytics <= 3.2.4 - Unauthenticated Google Analytics Data Exposure", "credits": [{"lang": "en", "type": "finder", "value": "ifoundbug"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"}}], "affected": [{"vendor": "sharethis", "product": "ShareThis Dashboard for Google Analytics", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T19:59:17.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6781dcc5-db95-43ca-9042-a3c05414b7e6?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/googleanalytics/trunk/credentials.json?rev=3364575"}], "descriptions": [{"lang": "en", "value": "The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Google Analytics client_ID and client_secret being stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to craft a link to the sharethis.com server, which will share an authorization token for Google Analytics with a malicious website, if the attacker can trick an administrator logged into the website and Google Analytics to click the link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:58:14.741Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12540", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:58:14.741Z", "dateReserved": "2025-10-30T23:18:03.695Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T08:21:52.708Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ShareThis Dashboard for Google Analytics", "vendor": "sharethis", "versions": [{"lessThanOrEqual": "3.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Google Analytics client_ID and client_secret being stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to craft a link to the sharethis.com server, which will share an authorization token for Google Analytics with a malicious website, if the attacker can trick an administrator logged into the website and Google Analytics to click the link."}, {"lang": "es", "value": "El plugin ShareThis Dashboard para Google Analytics para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta la 3.2.4, inclusive. Esto se debe a que el client_ID y el client_secret de Google Analytics se almacenan en texto plano en el c\u00f3digo fuente del plugin, visible p\u00fablicamente. Esto puede permitir a atacantes no autenticados crear un enlace al servidor sharethis.com, que compartir\u00e1 un token de autorizaci\u00f3n para Google Analytics con un sitio web malicioso, si el atacante puede enga\u00f1ar a un administrador que haya iniciado sesi\u00f3n en el sitio web y en Google Analytics para que haga clic en el enlace."}], "id": "CVE-2025-12540", "lastModified": "2026-06-17T08:32:33.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12540", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T16:37:31.948911Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:46.970", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/googleanalytics/trunk/credentials.json?rev=3364575"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6781dcc5-db95-43ca-9042-a3c05414b7e6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:45:20.834033+00:00", "value": {"mitigation_remediation": ["Upgrade the ShareThis Dashboard for Google Analytics plugin to the latest version (3.2.5 or later, where credentials are no longer stored in plaintext)", "If an upgrade is not possible, remove the client ID and client secret keys from the plugin\u2019s database or configuration files to prevent disclosure", "Consider switching to an alternative Google Analytics integration that stores credentials securely or uses OAuth flows that do not expose secrets in the code"], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "WordPress sites that install or have installed the ShareThis Dashboard for Google Analytics plugin version 3.2.4 or earlier. The exact affected product is the ShareThis Dashboard for Google Analytics plugin; no particular operating system or server environment is required beyond standard WordPress hosting.", "description_and_impact": "The ShareThis Dashboard for Google Analytics plugin stores the Google Analytics client ID and client secret in plaintext within its public source code for all releases up to and including version 3.2.4. This flaw allows a potential attacker to obtain those credentials and use them to impersonate the site or generate an authorization token that can be chained to a malicious site. The resulting vulnerability enables the exfiltration of Google Analytics data without requiring any authenticated access to the WordPress dashboard.", "risk_and_exploitability": "The CVSS score of 4.7 indicates a moderate impact risk, while the EPSS score of less than 1% suggests the likelihood of exploitation remains very low. The vulnerability is not listed in CISA\u2019s KEV catalog, further supporting the conclusion that there are currently no known widespread attacks. Attackers would need to lure a site administrator who is currently logged into both WordPress and Google Analytics into clicking a crafted link that forwards an access token to a malicious domain. This inferred attack vector requires social engineering rather than a purely automated exploit."}}}}, "created": "2026-01-08T09:49:46.007536+00:00", "updated": "2026-04-21T17:00:12.304918+00:00", "vendors": ["sharethis", "sharethis$PRODUCT$dashboard_for_google_analytics", "wordpress", "wordpress$PRODUCT$wordpress"]}