CVE-2023-41695 is a low severity (CVSS 3.5) missing authorization flaw in Analytify, the Google Analytics dashboard plugin for WordPress, in versions through 5.1.0. Patchstack lists 5.1.1 as the patched version. Update the plugin; the low score reflects limited impact and a required user action.
What's affected
The NVD record says Analytify is affected "from n/a through 5.1.0". Patchstack, which we read, lists 5.1.1 as the patched version and rates it a low priority issue with CVSS 3.5. The record and Patchstack agree on both the score and the range.
Patchstack describes the problem as broken access control and notes that a privileged user has to take an action for it to succeed, which fits the user interaction flag in the vector.
The record scores the flaw 3.5 (Low) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. It can be reached over the network, the attack complexity is low, it requires low privileges, and it needs a user to take part (for example by opening or visiting something). The impact on confidentiality is no, on integrity low and on availability no. The weakness class is CWE-862 (missing authorization). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the plugin version on every WordPress site you run. If you have WP-CLI access:
wp plugin get wp-analytify --fields=name,status,version
Or open Plugins in the dashboard and read the version under Analytify. Anything at or below 5.1.0 is in the affected range. Patchstack lists 5.1.1 as the patched version. Do not forget staging copies and rarely visited sites, and remove plugins you no longer use.
What to do now
- Update Analytify to 5.1.1 or later. With WP-CLI:
wp plugin update wp-analytify. - Include the plugin in your next routine update cycle if you cannot do it today; the risk is low.
- Check which roles can reach plugin settings on each site and reduce them.
Why it matters
The weakness is CWE-862, missing authorization: a function does not check whether the caller is allowed to use it. Here the effect is a small integrity change, and the attack needs a privileged user to be tricked into acting.
Low severity issues are easy to ignore. The practical point is that they cost little to fix and keep your plugin list clean, so the next serious advisory finds you already current. A site that updates plugins on a regular rhythm rarely has to scramble.
Quick check
Is CVE-2023-41695 urgent?
Not by itself. It scores 3.5 and needs a privileged user to take part. Update in your normal cycle, sooner if you can.
Which version fixes it?
Patchstack lists 5.1.1. The record names 5.1.0 and earlier as affected.
Sources
Last reviewed: 19 October 2026.
