CVE-2026-5488: CWE-862 Missing Authorization in smub ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin pages (including profile.php which subscribers can access), and while other similar AJAX endpoints in the same class properly check for the exactmetrics_save_settings capability, these two endpoints only verify the nonce. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve valid Google Ads access tokens and reset Google Ads integration settings.
AI Analysis
Technical Summary
CVE-2026-5488 describes a missing authorization vulnerability (CWE-862) in the ExactMetrics WordPress plugin up to version 9.1.2. The get_ads_access_token() and reset_experience() AJAX handlers fail to perform proper capability checks, relying solely on nonce verification. Since the nonce is available on all admin pages including those accessible by subscribers, attackers with subscriber-level privileges can exploit this to obtain valid Google Ads access tokens and reset Google Ads integration settings, potentially impacting the confidentiality of these tokens.
Potential Impact
Authenticated users with subscriber-level access or higher can retrieve valid Google Ads access tokens and reset Google Ads integration settings. This could lead to unauthorized access to Google Ads data associated with the plugin, compromising confidentiality. There is no indication of integrity or availability impact. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to Google Ads integration. Avoid granting unnecessary privileges to low-level users.
CVE-2026-5488: CWE-862 Missing Authorization in smub ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
Description
The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin pages (including profile.php which subscribers can access), and while other similar AJAX endpoints in the same class properly check for the exactmetrics_save_settings capability, these two endpoints only verify the nonce. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve valid Google Ads access tokens and reset Google Ads integration settings.
CVSS v3.1
Score 5.3medium
Affected software
smub
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-5488 describes a missing authorization vulnerability (CWE-862) in the ExactMetrics WordPress plugin up to version 9.1.2. The get_ads_access_token() and reset_experience() AJAX handlers fail to perform proper capability checks, relying solely on nonce verification. Since the nonce is available on all admin pages including those accessible by subscribers, attackers with subscriber-level privileges can exploit this to obtain valid Google Ads access tokens and reset Google Ads integration settings, potentially impacting the confidentiality of these tokens.
Potential Impact
Authenticated users with subscriber-level access or higher can retrieve valid Google Ads access tokens and reset Google Ads integration settings. This could lead to unauthorized access to Google Ads data associated with the plugin, compromising confidentiality. There is no indication of integrity or availability impact. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to Google Ads integration. Avoid granting unnecessary privileges to low-level users.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-04-03T14:31:57.183Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69eaec2d87115cfb68c0d944
Added to database: 04/24/2026, 04:06:05 UTC
Last enriched: 08/15/2026, 13:21:48 UTC
Last updated: 09/14/2026, 22:01:35 UTC
Views: 157
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.