The Analytify Pro plugin for WordPress versions up to and including 7.0.3 contains a sensitive information exposure vulnerability (CWE-200) that allows unauthenticated attackers to retrieve usernames by inspecting the source code related to the Analytify Tag HTML details. This vulnerability has been assigned CVE-2025-12521 with a CVSS 3.1 base score of 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. No official patch or remediation details are currently available from the vendor.

An unauthenticated attacker can obtain usernames from the affected plugin's source code, potentially aiding in further targeted attacks such as brute force or social engineering. The confidentiality impact is limited to username exposure; integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider limiting public access to pages where the plugin outputs sensitive HTML details or use alternative plugins without this exposure. Monitor vendor communications for updates on fixes.