CVE-2024-0250

MEDIUM NUCLEI

Deconf Analytics Insights < 6.3 - Open Redirect

Title source: rule

Description

The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

Exploits (1)

github WORKING POC 4 stars

by halilkirazkaya · poc

https://github.com/halilkirazkaya/cve-poc-garage/tree/main/2024/CVE-2024-0250.md

View Code ZIP pw:eip

Nuclei Templates (1)

Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect

MEDIUMVERIFIEDby s4e-io

FOFA: body="/wp-content/plugins/analytics-insights"

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/321b07d1-692f-48e9-a8e5-a15b38efa979/

Scores

CVSS v3 6.1

EPSS 0.2116

EPSS Percentile 95.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-601

Status published

Products (1)

deconf/analytics_insights < 6.3

Published Feb 12, 2024

Tracked Since Feb 18, 2026