AnalyticsWP

Versión 2.3.0 — 7 mayo 2025

• Seguridad Fixed an issue where several of the plugin's AJAX endpoints could be called without being logged in. This allowed an unauthenticated visitor to read stored analytics events — including visitor IP addresses, page URLs, referrers, and, for visitors who were logged in when the event was recorded, their email address — as well as retrieve the analytics report or have it emailed to an address of their choosing. Every endpoint now verifies the caller before doing any work. Reported by Valentin Univers-PC via WPScan (CVE-2026-19647, CVE-2026-19648).
• Seguridad Agency Mode requests between sites are now signed and verified correctly, and are no longer accepted on sites without an active licence.
• Seguridad Removed the permissive cross-origin header from endpoints that authenticate with an administrator session.
• Corregido Report previews and test report emails now only accept sites that are already configured as clients.
• Corregido The dashboard header showed “v2.0” regardless of the installed version.

Versiones anteriores

• 2.2.0 (20 abril 2025): 3 mejorado
• 2.1.5 (20 febrero 2025): 1 mejorado, 1 seguridad
• 2.0.0 (26 noviembre 2024): 7 nuevo, 7 mejorado