CVE-2026-5371: MonsterInsights WordPress Auth Bypass Flaw

CVE-2026-5371 Overview

CVE-2026-5371 is a missing authorization vulnerability in the MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin. The flaw affects all versions up to and including 10.1.2. The plugin fails to enforce capability checks on the get_ads_access_token() and reset_experience() functions. Authenticated attackers with Subscriber-level access or above can retrieve live Google OAuth access tokens and reset the plugin's Google Ads integration. The vulnerability is classified under [CWE-862] (Missing Authorization).

Critical Impact

Low-privileged WordPress users can exfiltrate live Google OAuth access tokens and tamper with the Google Ads integration state on affected sites.

Affected Products

• MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin
• All versions up to and including 10.1.2
• WordPress sites with Subscriber-level user registration enabled

Discovery Timeline

• 2026-05-12 - CVE-2026-5371 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-5371

Vulnerability Analysis

The vulnerability resides in two functions exposed by the MonsterInsights plugin: get_ads_access_token() and reset_experience(). Neither function performs capability checks before executing privileged operations. As a result, any authenticated session — including Subscriber accounts created through standard WordPress registration — can invoke these endpoints.

Invoking get_ads_access_token() returns a live Google OAuth access token tied to the site administrator's connected Google account. An attacker can use this token to query Google APIs on behalf of the victim's account, exposing analytics and advertising data. Invoking reset_experience() resets the plugin's Google Ads integration state, disrupting site configuration.

Root Cause

The root cause is the absence of current_user_can() or equivalent capability validation in the affected AJAX or admin handlers. The functions trust authenticated requests without confirming the caller holds an administrative role. Source references to the vulnerable handlers are available in the admin-assets.php source and class-monsterinsights-google-ads.php source.

Attack Vector

An attacker first obtains Subscriber-level access, which is trivial on sites that allow open user registration. The attacker then sends an authenticated HTTP request to the WordPress AJAX endpoint that dispatches to get_ads_access_token(). The server returns the OAuth token in the response body. A second request targeting reset_experience() clears the Google Ads integration. No user interaction is required from the administrator. See the Wordfence advisory for additional technical detail.

Detection Methods for CVE-2026-5371

Indicators of Compromise

• Unexpected AJAX requests from Subscriber-level accounts to MonsterInsights endpoints invoking get_ads_access_token or reset_experience actions.
• WordPress access logs showing repeated admin-ajax.php POST requests from low-privilege user sessions.
• Unexplained resets of the MonsterInsights Google Ads integration configuration.
• Google Cloud audit logs showing API calls originating from unfamiliar IP addresses using the site's OAuth token.

Detection Strategies

• Audit WordPress user roles and flag Subscriber accounts created from suspicious IPs or email domains.
• Review web server logs for action= parameters referencing the vulnerable function names against admin-ajax.php.
• Correlate plugin configuration changes with the user ID that initiated the request.

Monitoring Recommendations

• Enable WordPress activity logging to track AJAX calls and plugin configuration changes per user.
• Monitor outbound Google API activity for anomalous query volumes or unexpected client IPs.
• Alert on rotation or revocation events for Google OAuth tokens connected to MonsterInsights.

How to Mitigate CVE-2026-5371

Immediate Actions Required

• Update the MonsterInsights plugin to a version later than 10.1.2 as soon as the vendor releases a patched build.
• Revoke and rotate the Google OAuth tokens connected to MonsterInsights through the Google account security dashboard.
• Audit existing WordPress Subscriber accounts and remove unrecognized users.
• Temporarily disable open user registration if it is not required for site operations.

Patch Information

At the time of NVD publication, all versions up to and including 10.1.2 are affected. Site administrators should consult the Wordfence vulnerability record and the official MonsterInsights changelog for the fixed version number and apply the update through the WordPress plugin management console.

Workarounds

• Deactivate the MonsterInsights plugin until a patched version is installed.
• Restrict access to wp-admin/admin-ajax.php from unauthenticated and low-privilege sessions using a web application firewall rule.
• Disable new user registration by unchecking Settings → General → Membership in the WordPress admin panel.
• Disconnect the Google Ads integration from MonsterInsights until the plugin is updated.

# Configuration example: disable WordPress user registration via wp-cli
wp option update users_can_register 0