The ExactMetrics WordPress plugin up to version 9.1.2 contains a missing authorization vulnerability in the get_ads_access_token() and reset_experience() AJAX handlers. Unlike other AJAX endpoints in the plugin that check for the exactmetrics_save_settings capability, these two endpoints only verify a nonce, which is localized on all admin pages including those accessible by subscribers. This flaw enables authenticated users with subscriber-level privileges or higher to access sensitive Google Ads tokens and reset integration settings without proper authorization checks. The vulnerability is tracked as CVE-2026-5488 with a CVSS 3.1 base score of 5.3 (medium severity). No patch or official fix has been documented as of the publication date.

Authenticated users with subscriber-level access or higher can exploit this vulnerability to retrieve valid Google Ads access tokens and reset Google Ads integration settings within the ExactMetrics plugin. This could lead to unauthorized access to Google Ads data and disruption of Google Ads integration on the affected WordPress site. There is no indication of impact on confidentiality beyond token exposure, nor on integrity or availability beyond resetting settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access carefully and monitor plugin updates from the vendor. Avoid granting unnecessary privileges to low-level authenticated users. No official patch or temporary fix has been published at this time.