CVE-2026-5488 affects ExactMetrics and exposes Google Ads integration actions to authenticated Subscriber+ users. The get_ads_access_token() and reset_experience() AJAX handlers verify a nonce that is localized on profile.php but omit the exactmetrics_save_settings capability check. This can expose a live Google Ads access token or reset connected integration state.
| CVE | CVE-2026-5488 |
| Plugin Version | ExactMetrics <= 9.1.2, fixed in 9.1.3 |
| All Time | 52 043 802 |
| Active installations | 300 000+ |
| Publicly Published | April 23, 2026 |
| Last Updated | April 24, 2026 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-5488 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/google-analytics-dashboard-for-wp/exactmetrics-912-authenticated-subscriber-missing-authorization-to-google-ads-access-token-retrieval-via-ajax-action-exactmetrics-ads-get-token |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| June 27, 2026 | Plugin testing and vulnerability detection in ExactMetrics were completed. |
| June 29, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| April 23, 2026 | CVE-2026-5488 was publicly published by Wordfence. |
Discovery of the Vulnerability
The ExactMetrics Google Ads integration registers AJAX handlers for access token retrieval and experience reset. Both handlers accept the mi-admin-nonce, which is localized on admin pages that Subscribers can open, including profile.php. Unlike nearby settings actions, they do not require the exactmetrics_save_settings capability.
A low-privileged account can therefore reach integration code that should be restricted to administrators. The highest impact is disclosure of a valid third-party access token during its validity window, with access determined by the scopes granted by Google Ads.
Understanding of Missing Authorization attacks
AJAX nonces protect WordPress requests from cross site request forgery, but they are not capability checks. If the same nonce is exposed to every logged-in role, a Subscriber can submit the same request as an administrator. Sensitive integration handlers must independently verify the exact capability required to view credentials or change connection state.
Exploiting the Missing Authorization Vulnerability
The supplied request demonstrates that a Subscriber can invoke the related Google Ads experience reset handler with a nonce obtained from profile.php. Testing should be limited to an isolated integration because the action changes connected plugin state.
POC:
POC: 1. Log in with a Subscriber account. 2. Open wp-admin/profile.php. 3. Read the ExactMetrics admin setup nonce from exactmetrics-admin-setup-wizard-js-extra. 4. Send the request below in an isolated test site. POST /wp-admin/admin-ajax.php HTTP/1.1 Host: example.test Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Cookie: [Subscriber session] action=exactmetrics_ads_reset_experience&nonce=NONCE_FROM_PROFILE____
On a vulnerable version, the request is accepted without the exactmetrics_save_settings capability that protects comparable ExactMetrics settings operations.
Recommendations for Improved Security
Site owners should update ExactMetrics to version 9.1.3 or later and review the connected Google Ads account if an untrusted WordPress user had access during the vulnerable period. Developers should require exactmetrics_save_settings in both handlers, return an authorization error before integration code runs, and avoid localizing sensitive action nonces on pages available to roles that cannot manage the integration.
By addressing Missing Authorization issues like CVE-2026-5488, WordPress site owners can protect connected advertising credentials and integration settings from low-privileged account abuse. Stay vigilant, stay secure.
#WordPressSecurity #MissingAuthorization #AccessTokenSecurity #WebsiteSafety #StayProtected #MediumVulnerability
Use CleanTalk solutions to improve the security of your website
