CVE-2026-1992: ExactMetrics Plugin Auth Bypass Vulnerability

CVE-2026-1992 Overview

The ExactMetrics – Google Analytics Dashboard for WordPress plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in versions 8.6.0 through 9.0.2. The vulnerability exists in the store_settings() method within the ExactMetrics_Onboarding class, where a user-supplied triggered_by parameter is improperly used instead of the current user's ID for permission verification. This flaw allows authenticated attackers with the exactmetrics_save_settings capability to bypass the install_plugins capability check by specifying an administrator's user ID in the triggered_by parameter, enabling them to install arbitrary plugins and ultimately achieve Remote Code Execution.

Critical Impact

Authenticated attackers can bypass authorization controls to install arbitrary plugins, potentially leading to complete site compromise through Remote Code Execution.

Affected Products

• ExactMetrics – Google Analytics Dashboard for WordPress versions 8.6.0 through 9.0.2
• WordPress sites where administrators have granted non-admin users permission to view reports

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-1992 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-1992

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), which occurs when an application uses user-controlled input to access authorization decisions. In this case, the store_settings() method in the ExactMetrics_Onboarding class accepts a triggered_by parameter from user input and uses this value to check permissions rather than determining the actual authenticated user's ID server-side.

The vulnerability has a network-based attack vector with low complexity requirements. An attacker needs only low privileges (specifically the exactmetrics_save_settings capability) and no user interaction to exploit this flaw. The impact is significant across all three security dimensions—confidentiality, integrity, and availability—as successful exploitation can lead to arbitrary plugin installation and subsequent Remote Code Execution.

Root Cause

The root cause of this vulnerability lies in the trust placed in user-supplied data for authorization decisions. The store_settings() method accepts a triggered_by parameter from the HTTP request and uses this value to perform capability checks instead of retrieving the current user's actual ID from the WordPress authentication system. This violates the security principle of never trusting client-supplied data for access control decisions.

The vulnerability is limited in scope to WordPress sites where administrators have explicitly granted non-administrator users the permission to view analytics reports, which is a prerequisite for obtaining the exactmetrics_save_settings capability.

Attack Vector

The attack exploits the flawed authorization logic in the plugin's onboarding settings functionality. An attacker with the exactmetrics_save_settings capability can craft a malicious request to the store_settings() endpoint, including a triggered_by parameter set to an administrator's user ID. When the application processes this request, it checks the capabilities of the user specified in triggered_by rather than the actual requesting user, effectively allowing the attacker to inherit administrator permissions for the install_plugins capability check.

Once the authorization bypass is achieved, the attacker can install arbitrary plugins. By uploading a malicious plugin containing PHP webshell code or other backdoor functionality, the attacker achieves Remote Code Execution on the WordPress server.

The vulnerable code can be examined at the WordPress Plugin Source Code reference, and the security fix is documented in the WordPress Changeset Update.

Detection Methods for CVE-2026-1992

Indicators of Compromise

• Unexpected plugin installations, particularly plugins not from the official WordPress repository
• Web server logs showing POST requests to ExactMetrics onboarding endpoints with triggered_by parameters containing administrator user IDs
• Newly created or modified PHP files in the wp-content/plugins/ directory with suspicious content
• Unusual user activity from accounts with limited ExactMetrics permissions attempting administrative actions

Detection Strategies

• Monitor WordPress audit logs for plugin installation events initiated by non-administrator users
• Implement Web Application Firewall (WAF) rules to detect requests containing triggered_by parameters targeting administrator user IDs
• Review access control configurations in ExactMetrics to identify which users have been granted the exactmetrics_save_settings capability
• Perform regular file integrity monitoring on the WordPress installation to detect unauthorized plugin uploads

Monitoring Recommendations

• Enable verbose logging for WordPress plugin management activities
• Configure alerts for any plugin installation events from users without explicit install_plugins capability
• Monitor network traffic for suspicious POST requests to /wp-admin/admin-ajax.php containing ExactMetrics-related actions
• Regularly audit user capabilities and permissions within the ExactMetrics plugin settings

How to Mitigate CVE-2026-1992

Immediate Actions Required

• Update the ExactMetrics – Google Analytics Dashboard for WordPress plugin to version 9.0.3 or later immediately
• Review and restrict which user roles have been granted permission to view ExactMetrics reports
• Audit recently installed plugins for any unauthorized or suspicious additions
• Review server logs for evidence of exploitation attempts targeting the store_settings() endpoint
• Consider temporarily disabling the ExactMetrics plugin until the update can be applied

Patch Information

The vulnerability has been addressed in ExactMetrics versions released after 9.0.2. The fix ensures that the current authenticated user's ID is used for capability checks instead of accepting user-supplied values. Site administrators should update to the latest version through the WordPress admin dashboard or by downloading the patched version from the WordPress plugin repository.

For additional details on the vulnerability and patch, refer to the Wordfence Vulnerability Report.

Workarounds

• Immediately revoke the exactmetrics_save_settings capability from all non-administrator users until the plugin is updated
• Implement WAF rules to block requests containing triggered_by parameters to ExactMetrics endpoints
• Restrict access to WordPress admin AJAX endpoints using server-level access controls
• Consider using a security plugin to enforce strict capability checks on plugin installation actions

# Restrict ExactMetrics endpoint access via .htaccess (temporary mitigation)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax.php$
    RewriteCond %{QUERY_STRING} exactmetrics [NC,OR]
    RewriteCond %{REQUEST_BODY} triggered_by [NC]
    RewriteRule .* - [F,L]
</IfModule>