ExactMetrics CVE-2026-5464

Attacker must possess valid WordPress Editor-level credentials (or higher role such as Administrator) on the target site with the 'exactmetrics_view_dashboard' capability explicitly granted. ExactMetrics plugin versions through 9.1.2 must be installed and active. The WordPress site must allow outbound HTTPS connections to attacker-controlled servers for downloading malicious plugin ZIP files (common configuration in standard hosting). Exploitation is limited to multi-author WordPress installations where Editor role exists-single-administrator sites have reduced attack surface. No user interaction required after initial credential compromise (UI:N). Attack succeeds against default ExactMetrics configurations without requiring specific feature enablement or non-standard settings. The 'onboarding_key' transient must be present (generated during plugin activation/onboarding flow), though source code suggests this persists across dashboard page loads for users with viewing permissions.

Despite the moderate CVSS base score of 7.2, this vulnerability presents CRITICAL real-world risk for multi-author WordPress installations. The CVSS vector (AV:N/AC:L/PR:H/UI:N) accurately captures network attack vector with low complexity but high privilege requirement-attackers need Editor role with 'exactmetrics_view_dashboard' capability. However, this significantly underestimates impact severity: successful exploitation grants complete server-level code execution, not just WordPress application compromise (scope should arguably be Changed). The three-endpoint authentication chain (transient exposure → REST API → AJAX handler) is programmatically automatable once Editor credentials are obtained. Primary risk scenarios include: (1) compromised Editor accounts in shared hosting environments, (2) insider threats in multi-contributor sites, (3) credential stuffing attacks against Editor-level users, and (4) privilege escalation chains where lower-privilege users first escalate to Editor then exploit this RCE path. The lack of EPSS data prevents quantifying likelihood of mass exploitation, but Wordfence's detailed disclosure with code references significantly lowers attacker research burden. No CISA KEV listing suggests no confirmed mass exploitation campaigns yet, but the straightforward exploit chain (no memory corruption, no race conditions-just HTTP requests with exposed tokens) makes weaponization trivial for targeted attacks. Sites running ExactMetrics with multiple Editor-level users face immediate risk.

An attacker compromises Editor credentials on a WordPress site running ExactMetrics (via phishing, credential stuffing, or session hijacking). They authenticate and navigate to the ExactMetrics dashboard, where JavaScript at admin-assets.php line 932 exposes the 'onboarding_key' transient in the page source. Using this key, they send a GET request to '/wp-json/exactmetrics/v1/onboarding/connect-url' to obtain a valid one-time hash token. With this OTH, they craft a POST to '/wp-admin/admin-ajax.php?action=exactmetrics_connect_process' including the OTH and a malicious 'file' parameter pointing to their hosted plugin ZIP containing a web shell. The AJAX handler at connect.php line 219 validates only the OTH (no capability check), downloads the malicious ZIP, installs it to wp-content/plugins, and activates it-granting the attacker persistent code execution. Public proof-of-concept not confirmed but exploit complexity is low given detailed Wordfence code references.