CVE-2024-12561

MEDIUM

Google Analytics & WordPress <1.4.9 - Open Redirect

Title source: llm

Description

The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.0.0. This is due to insufficient validation on the redirect url supplied via the 'afflink' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

References (3)

Core 3

Core References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3320552%40wecantrack&new=3320552%40wecantrack&sfp_email=&sfph_mail=

Product

https://plugins.trac.wordpress.org/browser/wecantrack/trunk/WecantrackApp.php#L66

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b205ab-f042-46d9-a331-f18809477384?source=cve

Scores

CVSS v3 6.1

EPSS 0.0029

EPSS Percentile 20.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-601

Status published

Products (2)

wecantrack/Affiliate Sales in Google Analytics and other tools < 1.4.9

wecantrack/Affiliate Sales in Google Analytics and other tools < 2.0.0

Published May 21, 2025

Tracked Since Feb 18, 2026