The ShareThis Dashboard for Google Analytics plugin stores the Google Analytics client ID and client secret in plaintext within its public source code for all releases up to and including version 3.2.4. This flaw allows a potential attacker to obtain those credentials and use them to impersonate the site or generate an authorization token that can be chained to a malicious site. The resulting vulnerability enables the exfiltration of Google Analytics data without requiring any authenticated access to the WordPress dashboard.

WordPress sites that install or have installed the ShareThis Dashboard for Google Analytics plugin version 3.2.4 or earlier. The exact affected product is the ShareThis Dashboard for Google Analytics plugin; no particular operating system or server environment is required beyond standard WordPress hosting.

The CVSS score of 4.7 indicates a moderate impact risk, while the EPSS score of less than 1% suggests the likelihood of exploitation remains very low. The vulnerability is not listed in CISA’s KEV catalog, further supporting the conclusion that there are currently no known widespread attacks. Attackers would need to lure a site administrator who is currently logged into both WordPress and Google Analytics into clicking a crafted link that forwards an access token to a malicious domain. This inferred attack vector requires social engineering rather than a purely automated exploit.