CVE-2026-5488: ExactMetrics Auth Bypass Vulnerability

CVE-2026-5488 Overview

The ExactMetrics – Google Analytics Dashboard for WordPress plugin contains a Missing Authorization vulnerability in versions up to and including 9.1.2. This security flaw exists due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin pages (including profile.php which subscribers can access), and while other similar AJAX endpoints in the same class properly check for the exactmetrics_save_settings capability, these two endpoints only verify the nonce. This allows authenticated attackers with subscriber-level access and above to retrieve valid Google Ads access tokens and reset Google Ads integration settings.

Critical Impact

Authenticated users with minimal privileges (subscriber-level) can access sensitive Google Ads access tokens and manipulate Google Ads integration settings, potentially leading to unauthorized access to connected Google Ads accounts.

Affected Products

• ExactMetrics – Google Analytics Dashboard for WordPress plugin versions up to and including 9.1.2
• WordPress installations using the vulnerable ExactMetrics plugin
• Sites with Google Ads integration configured through ExactMetrics

Discovery Timeline

• 2026-04-24 - CVE CVE-2026-5488 published to NVD
• 2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-5488

Vulnerability Analysis

This vulnerability falls under CWE-862 (Missing Authorization), a common security weakness where the software does not perform authorization checks when an actor attempts to access a resource or perform an action. In WordPress plugin development, proper authorization requires both nonce verification AND capability checks to ensure users have appropriate permissions.

The ExactMetrics plugin correctly implements nonce verification on the vulnerable AJAX endpoints to prevent Cross-Site Request Forgery (CSRF) attacks. However, the plugin fails to implement the necessary capability checks that would restrict these actions to administrators or users with the exactmetrics_save_settings capability. This inconsistency is particularly notable because other AJAX endpoints in the same class properly implement these capability checks.

Root Cause

The root cause of this vulnerability is an incomplete access control implementation in the plugin's AJAX handlers. The get_ads_access_token() and reset_experience() functions in class-exactmetrics-google-ads.php only verify that the request includes a valid nonce but do not check if the current user has the required capabilities to perform these sensitive operations.

The mi-admin-nonce is accessible to all authenticated users because it is localized on all admin pages, including profile.php, which subscribers can access. This means any authenticated user can obtain a valid nonce and use it to call these vulnerable endpoints.

Attack Vector

The attack vector is network-based and requires authentication with at least subscriber-level access. An attacker with a valid WordPress account (even with minimal privileges) can:

1. Access any admin page available to their role (such as profile.php) to obtain the mi-admin-nonce
2. Craft AJAX requests to the vulnerable endpoints using the obtained nonce
3. Call get_ads_access_token() to retrieve valid Google Ads access tokens
4. Call reset_experience() to reset the Google Ads integration settings

The vulnerability mechanism involves exploiting the gap between nonce validation and capability verification. When a subscriber-level user accesses an admin page, WordPress localizes the mi-admin-nonce value in the page's JavaScript context. The attacker can extract this nonce and use it to authenticate AJAX calls to the vulnerable endpoints.

For technical implementation details, refer to the WordPress Google Ads Class Code and the WordPress Admin Assets Code in the WordPress plugin repository.

Detection Methods for CVE-2026-5488

Indicators of Compromise

• Unusual AJAX requests to exactmetrics_get_ads_access_token or exactmetrics_reset_experience actions from non-administrator users
• Unexpected changes to Google Ads integration settings in the ExactMetrics plugin
• Access logs showing subscriber or contributor-level users accessing Google Ads related plugin functionality
• Suspicious activity in Google Ads accounts linked through ExactMetrics

Detection Strategies

• Monitor WordPress AJAX request logs for calls to vulnerable endpoints from users without administrative privileges
• Implement Web Application Firewall (WAF) rules to detect and alert on suspicious AJAX patterns targeting ExactMetrics endpoints
• Review WordPress user activity logs for unauthorized access attempts to plugin settings
• Enable detailed logging for the ExactMetrics plugin if available

Monitoring Recommendations

• Configure SentinelOne to monitor for anomalous WordPress plugin activity and unauthorized privilege usage
• Set up alerts for changes to Google Analytics or Google Ads integration settings
• Implement file integrity monitoring on the ExactMetrics plugin directory to detect unauthorized modifications
• Regularly audit user accounts and their activity, especially those with subscriber-level access

How to Mitigate CVE-2026-5488

Immediate Actions Required

• Update the ExactMetrics – Google Analytics Dashboard for WordPress plugin to a version newer than 9.1.2
• Review Google Ads access tokens that may have been exposed and revoke/regenerate them if necessary
• Audit subscriber and contributor-level user accounts for any suspicious activity
• Consider temporarily restricting access to the WordPress admin area for non-essential users until the patch is applied

Patch Information

A security patch has been released addressing this vulnerability. The fix adds proper capability checks to the get_ads_access_token() and reset_experience() AJAX handlers, ensuring that only users with the exactmetrics_save_settings capability can access these functions. Review the WordPress Change Set Information for detailed patch information.

For additional vulnerability details, consult the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the ExactMetrics plugin until a patched version can be installed
• Restrict WordPress user registrations and remove unnecessary subscriber accounts
• Implement a Web Application Firewall rule to block AJAX requests to the vulnerable endpoints from non-administrator users
• Use a security plugin to add additional capability checks for sensitive AJAX actions

# Configuration example - Disable public user registration in wp-config.php
# Add this to your wp-config.php to prevent new subscriber registrations
define('DISALLOW_FILE_EDIT', true);

# Review and remove unused subscriber accounts via WP-CLI
wp user list --role=subscriber --format=table
wp user delete [user_id] --reassign=[admin_id]