CVE-2026-5488 is a missing authorization vulnerability in the ExactMetrics WordPress plugin (up to version 9.1.2). The issue arises because the AJAX handlers get_ads_access_token() and reset_experience() do not verify user capabilities, only checking a nonce. Since the nonce is localized on all admin pages, including those accessible by subscribers, this allows any authenticated user with subscriber-level privileges or higher to access Google Ads tokens and reset integration settings without proper authorization. Other AJAX endpoints in the same plugin correctly enforce capability checks, highlighting this as an oversight in these two handlers.

An attacker with subscriber-level access or higher can retrieve valid Google Ads access tokens and reset Google Ads integration settings. This could lead to unauthorized access to Google Ads data and disruption of the plugin's integration with Google Ads. There is no indication of privilege escalation beyond subscriber-level access or direct system compromise. The impact is limited to confidentiality and integrity of Google Ads integration within the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to Google Ads integration. Avoid granting subscriber or higher privileges to untrusted users. Follow vendor updates closely for an official fix or temporary mitigation.