CVE-2025-39388

WordPress AnalyticsWP plugin <= 2.0.0 - Broken Access Control vulnerability

View on CVE.org
Published May 19, 2025 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through 2.0.0.

Analysis

AI-generated

Technical impact

The vulnerability is a missing authorization flaw that allows an attacker to invoke functionality in the AnalyticsWP plugin that should be limited to privileged users. Because the ACLs are not properly enforced, the functionality is not properly restricted, leading to unauthorized access to plugin features.

Affected Systems

All versions of the Solid Plugins AnalyticsWP plugin up to and including 2.0.0 are affected. The vulnerability applies to every deployment that uses these versions without any additional custom restrictions. Any WordPress installation that has the plugin installed and is publicly accessible is at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity, the EPSS score of less than 1% suggests a low likelihood of exploitation, and the plugin is not in the CISA KEV catalog. The vulnerability involves the plugin’s web interfaces, but the exact attack vector is not explicitly stated in the description and thus requires additional analysis.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the AnalyticsWP plugin to the latest version released (any version newer than 2.0.0).
  • Restrict plugin endpoint access to users with appropriate WordPress roles or by adding capability checks.
  • If no upgrade is possible, disable or delete the plugin until a patch is released.

Generated by OpenCVE AI on May 2, 2026 at 01:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-27950 Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through 2.0.0.
History
Type Values Removed Values Added
Description Missing Authorization vulnerability in Solid Plugins AnalyticsWP analyticswp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through <= 2.0.0. Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through 2.0.0.
References
Type Values Removed Values Added
Description Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through 2.0.0. Missing Authorization vulnerability in Solid Plugins AnalyticsWP analyticswp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through <= 2.0.0.
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through 2.0.0.
Title WordPress AnalyticsWP plugin <= 2.0.0 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}
Earlier changes (1)

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:12 PM
Reserved
Apr 16, 2025, 6:22 AM

View source JSON

Updated
May 20, 2025, 2:09 PM

JSON

Status
Deferred
Published
May 19, 2025, 5:15 PM
Modified
Jun 17, 2026, 9:17 AM

View source JSON

No data.

Updated
May 2, 2026, 1:45 AM

JSON