smub ExactMetrics Plugin up to 9.1.2 on WordPress profile.php get_ads_access_token authorization

Summaryinfo

A vulnerability has been found in smub ExactMetrics Plugin up to 9.1.2 on WordPress and classified as problematic. This affects the function get_ads_access_token of the file profile.php. This manipulation causes authorization. This vulnerability is tracked as CVE-2026-5488. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in smub ExactMetrics Plugin up to 9.1.2 on WordPress and classified as problematic. Affected by this vulnerability is the function get_ads_access_token of the file profile.php. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality. The summary by CVE is:

The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin pages (including profile.php which subscribers can access), and while other similar AJAX endpoints in the same class properly check for the exactmetrics_save_settings capability, these two endpoints only verify the nonce. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve valid Google Ads access tokens and reset Google Ads integration settings.

The weakness was disclosed by Dmitrii Ignatyev. The advisory is shared at wordfence.com. This vulnerability is known as CVE-2026-5488 since 04/03/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available.

By approaching the search of inurl:profile.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 9.0.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• smub

Name

• ExactMetrics Plugin

Version

• 9.1.0
• 9.1.1
• 9.1.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion