CVE-2025-12540 is a vulnerability in the ShareThis Dashboard for Google Analytics WordPress plugin (all versions up to 3.2.4) where the Google Analytics client_ID and client_secret are stored in plaintext in the publicly accessible plugin source code. This exposure enables unauthenticated attackers to create crafted links that, when clicked by an administrator authenticated to both the WordPress site and Google Analytics, can cause an authorization token to be shared with a malicious website. The vulnerability is categorized under CWE-200 for sensitive information exposure and has a medium severity CVSS score of 4.7. There is no indication of known exploits in the wild or available patches.

The vulnerability allows unauthorized actors to access sensitive Google Analytics credentials (client_ID and client_secret) by viewing the plugin source code. This can lead to unauthorized sharing of Google Analytics authorization tokens if an administrator is tricked into clicking a crafted link. The impact is limited to confidentiality (partial information disclosure) without direct integrity or availability effects. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking suspicious links related to the ShareThis Dashboard plugin and consider removing or disabling the plugin if possible. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.