CVE-2022-45830 is a medium severity (CVSS 6.5) missing authorization flaw in the Analytify Google Analytics dashboard plugin for WordPress, versions up to 4.2.3. Patchstack lists it as a privilege escalation and says it is fixed in version 4.3.0. Update to 4.3.0 or later.
What's affected
Analytify, the Google Analytics dashboard plugin for WordPress (slug wp-analytify), versions from n/a through 4.2.3, per the record. Patchstack's entry lists the same range, names 4.3.0 as the patched version and says to update to 4.3.0 or later.
The record is short: it says only that a missing authorization vulnerability exists. Patchstack's page classifies it as privilege escalation under broken access control. It lists the required privilege as unauthenticated, while the title describes a low privilege user becoming an administrator. The two descriptions differ, so treat the plugin as risky to leave in place whoever can reach the site.
Patchstack's page is dated 29 December 2022.
How to check if you're exposed
List the installed version with WP-CLI:
wp plugin get wp-analytify --fields=name,status,version
Or open the Plugins page in the WordPress admin and read the version for Analytify. Anything at 4.2.3 or below is in scope.
For many sites, run the same command in a loop, or use your hosting provider's plugin inventory. Include staging copies and sites you rarely open.
Then review the Users page for accounts you do not recognise, in particular administrators. A privilege escalation flaw is often followed by a new account.
What to do now
- Find all WordPress sites with the Analytify plugin installed.
- Update to 4.3.0 or later, the version Patchstack lists as patched.
- Review the user list for unfamiliar accounts, and check that no ordinary user has an administrator role.
- If you cannot update, deactivate the plugin until you can.
- Turn on automatic updates for plugins that you do not customise, and review the list of installed plugins for ones you no longer use.
Why it matters
The record classes this as CWE-862 (Missing Authorization). A function in the plugin performs an action without checking whether the current user is allowed to do it. In WordPress, that usually means a handler that checks that a request is well formed but not that the caller has the right capability.
Missing authorization is one of the most common plugin flaws, and one of the easiest to introduce. A developer builds a feature for administrators, wires it to a request handler and forgets that the handler can be called by anyone. The fix is a capability check at the start of every handler.
Patchstack notes that this class of flaw is used in mass exploitation campaigns against WordPress sites. That is general guidance on the class, not a claim about this specific CVE. The record does not mark it as CISA KEV.
Try it yourself
When the fix is a plugin update, the hard part is finding every site that needs it. This demo shows how a scan surfaces the fixed version for you.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Patchstack lists 4.3.0 as the patched version, so update to 4.3.0 or later.
Is this exploited?
The record makes no claim of exploitation and the CISA KEV flag is false. Patchstack says the class is commonly used in mass campaigns, which is general guidance.
Sources
Last reviewed: 19 October 2026.
