What is the CVSS score of CVE-2026-5371?

CVE-2026-5371 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of MonsterInsights are affected by CVE-2026-5371?

The MonsterInsights WordPress plugin (versions ≤10.1.2) contains an access control vulnerability that could allow site subscribers to expose live Google account credentials and sabotage advertising…

How to fix or mitigate CVE-2026-5371?

Within 24 hours: Identify all WordPress installations running MonsterInsights versions 10.1.2 or earlier; review and restrict Subscriber-level access to only trusted users; generate new Google OAuth tokens and audit your Google Ads/Analytics account for unauthorized access. Within 7 days: Deploy access logging and monitoring for plugin API functions; implement Web Application Firewall rules to restrict calls to get_ads_access_token() and reset_experience(); conduct forensic review of Google account activity logs for evidence of compromise. Within 30 days: Upgrade MonsterInsights to version 10.1.3 or later when available, or decommission the plugin and migrate to an alternative analytics solution with proper access controls.

MonsterInsights CVE-2026-5371

EUVD-2026-29886 HIGH

Missing Authorization (CWE-862)

2026-05-12 Wordfence

GHSA-wx44-v3qh-c2jf

WordPress Authentication Bypass Google Wordpress Plugin Monsterinsights Google Analytics Dashboard For Wordpress Website Stats Made Easy

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-reachable AJAX action needing only a Subscriber account (PR:L); high confidentiality from live OAuth token disclosure, low integrity from integration reset, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:08 vuln.today

CVE Published

May 12, 2026 - 22:24 nvd

HIGH 7.1

DescriptionCVE.org

The MonsterInsights - Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability checks on the get_ads_access_token() and reset_experience() functions in all versions up to, and including, 10.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve live Google OAuth access tokens and reset Plugins's Google Ads integration.

AnalysisAI

Broken access control in the MonsterInsights Google Analytics plugin for WordPress (versions up to and including 10.1.2) lets any authenticated user with Subscriber-level access or higher call the unprotected get_ads_access_token() and reset_experience() functions, exposing live Google OAuth access tokens and letting them reset the plugin's Google Ads integration. The disclosed OAuth tokens can be abused to access the linked Google Ads/Analytics account outside WordPress, while the reset function disrupts the site's advertising integration. No public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with SSVC exploitation status of 'none'.

Technical ContextAI

The vulnerability sits in MonsterInsights (plugin slug google-analytics-for-wordpress, vendor chriscct7), a widely deployed WordPress plugin that connects sites to Google Analytics and Google Ads (PPC) via OAuth. The root cause is CWE-862 (Missing Authorization): two AJAX/handler functions - get_ads_access_token() in the Google Ads integration class and reset_experience() - are registered without an accompanying current_user_can() capability check or nonce-gated authorization gate. Because WordPress AJAX actions hooked for logged-in users are reachable by any authenticated account (including the low-privilege Subscriber role), the OAuth access token stored server-side for the Google Ads integration is returned to callers who should never see it, and the integration state can be reset. Referenced source lines (class-monsterinsights-google-ads.php and admin-assets.php in tag 10.0.3) locate the token-handling and reset logic.

RemediationAI

Upgrade the MonsterInsights plugin to the first release above 10.1.2 (the next patched version after the vulnerable 10.1.2); an exact fixed version is not stated in the provided data, so confirm the current patched release on the WordPress.org plugin page or the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/5d380b66-675e-451d-a7e3-4efe1fbd08b2) before deploying. Until patched, reduce exposure by disabling open user self-registration or tightening the default new-user role so untrusted accounts cannot reach Subscriber-level AJAX actions, and audit existing low-privilege accounts. As a stronger compensating control, deactivate the MonsterInsights Google Ads/PPC integration or the plugin itself if the Ads feature is in use, and rotate/revoke the linked Google OAuth credentials in the Google account since existing tokens may already be exposed - the trade-off is loss of Ads and analytics dashboard functionality until re-authorized. A WordPress WAF with a rule blocking the affected AJAX actions for non-admin users provides interim virtual patching.