What’s Vulnerable › Vulnerabilities

CVE-2025-1507: ShareThis Dashboard for Google Analytics <= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-14 · updated 2026-06-17
• Weakness: CWE-862

Description

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_actions() function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all features.

Affected products

• ShareThis Dashboard for Google Analytics: before 3.2.2 — fixed in 3.2.2

How to fix

Upgrade to a fixed version: ShareThis Dashboard for Google Analytics 3.2.2. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/3255511/googleanalytics/trunk/class/core/class-ga-controller-core.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/314b8638-15e7-461d-a705-3858fe6813e7?source=cve

Get alerted when CVE-2025-1507 or the next vulnerability affects your stack