CVE-2026-5488 smub CVE debrief

Who should care

WordPress administrators and users with subscriber-level access or above who have the ExactMetrics – Google Analytics Dashboard for WordPress plugin installed should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes verifying installed plugin versions, restricting access to sensitive AJAX endpoints, and implementing additional authentication and authorization checks. Furthermore, they should monitor for suspicious activity related to Google Ads access tokens and apply vendor patches or updates when available. It is also recommended to review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Additionally, compensating controls for exposed systems should be reviewed while remediation is scheduled and verified, and relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions should be tracked, remediated assets should be retested, and the item should only be closed after evidence is documented. This vulnerability can be exploited by authenticated attackers with subscriber-level access to retrieve valid Google Ads access tokens and reset Google Ads integration settings, potentially leading to unauthorized access or modification of sensitive data. Therefore, it is crucial for WordPress administrators and users with subscriber-level access or above to take immediate action to prevent exploitation and protect their systems from potential attacks. They should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. By taking these precautions, WordPress administrators and users with subscriber-level access or above can help prevent exploitation of this vulnerability and protect their systems from potential attacks. The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2, and this vulnerability can be exploited by authenticated attackers with subscriber-level

Technical summary

The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin pages (including profile.php which subscribers can access), and while other similar AJAX endpoints in the same class properly check for the exactmetrics_save_settings capability, these two endpoints only verify the nonce. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve valid Google Ads access tokens and reset Google Ads integration settings. WordPress administrators and users with subscriber-level access or above should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Defensive priority

Authenticated attackers with subscriber-level access can exploit this vulnerability to retrieve valid Google Ads access tokens and reset Google Ads integration settings, potentially leading to unauthorized access or modification of sensitive data.

Recommended defensive actions

• Inventory and verify installed plugin versions.
• Restrict access to sensitive AJAX endpoints.
• Implement additional authentication and authorization checks.
• Monitor for suspicious activity related to Google Ads access tokens.
• Apply vendor patches or updates when available.

Evidence notes

The vulnerability is caused by missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. The mi-admin-nonce is localized on all admin pages, but only these two endpoints verify the nonce instead of checking for the exactmetrics_save_settings capability.

Official resources