CVE-2026-5488 Overview
CVE-2026-5488 is a Missing Authorization vulnerability [CWE-862] in the ExactMetrics – Google Analytics Dashboard for WordPress plugin. The flaw affects all versions up to and including 9.1.2. The plugin fails to enforce capability checks on the get_ads_access_token() and reset_experience() AJAX handlers. Authenticated users with subscriber-level access can retrieve valid Google Ads access tokens and reset Google Ads integration settings. The mi-admin-nonce is exposed on profile.php, a page accessible to subscriber accounts, which removes the nonce as an effective access barrier.
Critical Impact
Subscriber-level WordPress users can exfiltrate Google Ads OAuth access tokens and reset the site's Google Ads integration configuration.
Affected Products
- ExactMetrics – Google Analytics Dashboard for WordPress plugin
- All versions up to and including 9.1.2
- WordPress sites with subscriber registration enabled
Discovery Timeline
- 2026-04-24 - CVE-2026-5488 published to NVD
- 2026-04-24 - Last updated in NVD database
Technical Details for CVE-2026-5488
Vulnerability Analysis
The vulnerability resides in two AJAX handlers within the plugin's Google Ads integration class. The get_ads_access_token() handler returns valid Google Ads OAuth access tokens to the caller. The reset_experience() handler clears stored Google Ads integration settings. Both handlers validate only the mi-admin-nonce value and omit a capability check such as current_user_can( 'exactmetrics_save_settings' ). Other similar endpoints in the same class correctly verify this capability, making these two handlers an inconsistency. An authenticated attacker can call these endpoints over the network and recover OAuth tokens that grant programmatic access to the site owner's Google Ads account data.
Root Cause
The root cause is missing authorization logic in the AJAX handler functions. The mi-admin-nonce is localized on all admin pages, including profile.php, which any authenticated subscriber can load. A subscriber can therefore extract a valid nonce and pass the only check the vulnerable handlers perform. The plugin relies on nonces as an authorization mechanism, but nonces are designed for CSRF protection rather than privilege enforcement.
Attack Vector
An attacker registers or authenticates as a subscriber, loads profile.php, and parses the localized mi-admin-nonce value from the page source. The attacker then issues authenticated AJAX requests to the wp-admin/admin-ajax.php endpoint with the action mapped to get_ads_access_token(). The response contains a valid Google Ads access token. A second request to the reset_experience() action clears the site's Google Ads integration state.
No verified public exploit code is available. See the Wordfence Vulnerability Analysis and the WordPress Plugin Google Ads Class source for technical details.
Detection Methods for CVE-2026-5488
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php from low-privilege user sessions invoking the get_ads_access_token or reset_experience actions.
- Unexpected resets of the ExactMetrics Google Ads integration or missing stored OAuth credentials.
- Anomalous activity in the linked Google Ads account that does not correlate with administrative actions on the WordPress site.
Detection Strategies
- Review WordPress access logs for AJAX requests to the two affected actions originating from subscriber, contributor, or author accounts.
- Audit user enumeration patterns and recent low-privilege account registrations that precede AJAX traffic to the plugin endpoints.
- Correlate WordPress authentication events with outbound Google Ads API activity to identify token reuse from unexpected locations.
Monitoring Recommendations
- Enable verbose WordPress and web server logging for admin-ajax.php requests and retain logs for incident review.
- Monitor for new subscriber account creation paired with rapid access to profile.php and admin-ajax.php.
- Configure alerting in the Google Ads account for new API client activity or unusual access patterns.
How to Mitigate CVE-2026-5488
Immediate Actions Required
- Update the ExactMetrics plugin to a version newer than 9.1.2 that includes the capability check fix.
- Rotate Google Ads OAuth credentials and revoke any access tokens that may have been issued while the vulnerable version was installed.
- Disable open user registration or restrict the default new-user role if subscriber accounts are not required.
- Audit existing subscriber-level accounts and remove any that cannot be attributed to legitimate users.
Patch Information
The vendor addressed the issue in a plugin update tracked in the WordPress Plugin Changeset. Site operators should upgrade through the WordPress plugin manager and verify the installed version is above 9.1.2.
Workarounds
- Deactivate the ExactMetrics plugin until the patched version is applied if Google Ads integration is not in active use.
- Restrict access to /wp-admin/admin-ajax.php for low-privilege roles using a web application firewall rule that blocks the get_ads_access_token and reset_experience actions.
- Remove the Google Ads integration configuration and disconnect the OAuth link until patching is complete.
# Example WAF rule pattern to block the vulnerable AJAX actions
# Block POST requests to admin-ajax.php carrying the affected actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1026548801,msg:'Block ExactMetrics CVE-2026-5488 actions'"
SecRule ARGS:action "@rx ^(get_ads_access_token|reset_experience)$"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
