CVE-2026-5371 is a missing authorization vulnerability (CWE-862) in the MonsterInsights – Google Analytics Dashboard for WordPress plugin, affecting all versions up to and including 10.1.2. The issue is due to absent capability checks on the get_ads_access_token() and reset_experience() functions, which enables authenticated users with Subscriber-level privileges or higher to retrieve live Google OAuth access tokens and reset the plugin's Google Ads integration. This vulnerability allows unauthorized access to sensitive data and partial modification of plugin settings. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact with limited integrity impact and no availability impact.

An attacker with at least Subscriber-level access to a WordPress site using the vulnerable MonsterInsights plugin can retrieve live Google OAuth access tokens, potentially exposing sensitive Google Analytics and Ads data. Additionally, the attacker can reset the plugin's Google Ads integration, which may disrupt analytics and advertising configurations. The confidentiality impact is high, while integrity impact is low and availability is not affected. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to Google OAuth tokens and plugin settings. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor for an official patch or mitigation instructions.