CVE-2025-12521— Analytify Pro <= 7.0.3 - Unauthenticated Information Exposure
Quick assessment
Affected
Analytify Analytify Pro
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Analytify Pro 7.0.3及之前版本存在信息泄露漏洞，该漏洞源于Analytify Tag HTML细节导致敏感信息泄露，可能导致未经验证的攻击者提取用户名。
Possible ATT&CK Techniques 1 AI
T1213 · Data from Information Repositories
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-12521
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Analytify Pro <= 7.0.3 - Unauthenticated Information Exposure
Source: CVE Program / CVE List V5
Vulnerability Description
The Analytify Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0.3 via the Analytify Tag HTML details. This makes it possible for unauthenticated attackers to extract usernames from source code. While we generally do not assign CVE IDs to username exposure issues, this vendor has specifically requested we consider it a vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Analytify Pro 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Analytify Pro 7.0.3及之前版本存在信息泄露漏洞，该漏洞源于Analytify Tag HTML细节导致敏感信息泄露，可能导致未经验证的攻击者提取用户名。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Analytify | Analytify Pro | * ~ 7.0.3 | - |
|
II. Public POCs for CVE-2025-12521
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-12521
请登录查看更多情报信息。
Other References for CVE-2025-12521 (1)
IV. Related Vulnerabilities
Same vendor: Analytify
-
CVE-2026-34904
WordPress Simple Social Media Share Buttons plugin <= 6.2.0 -
CVE-2026-34896
WordPress Under Construction, Coming Soon & Maintenance Mode -
CVE-2022-45830
WordPress Analytify - Google Analytics Dashboard plugin <= 4 -
CVE-2023-47841
WordPress Analytify plugin <= 5.1.1 - Broken Access Control -
CVE-2024-43265
WordPress Analytify plugin <= 5.3.1 - CSRF Leading to Optout
Same weakness: CWE-200
-
CVE-2026-18496
Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Infor -
CVE-2026-103964
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sen -
CVE-2026-103365
Online Scheduling and Appointment Booking System <= 28.4 - U -
CVE-2026-107842
Contao: Protected page content is disclosed to anonymous vis -
CVE-2026-107811
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Al
V. Comments for CVE-2025-12521
No comments yet