What is the CVSS score of CVE-2026-5464?

CVE-2026-5464 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of ExactMetrics are affected by CVE-2026-5464?

ExactMetrics WordPress plugin versions 9.1.2 and earlier contain a critical remote code execution vulnerability allowing authenticated Editor-level users to install and execute arbitrary plugins by…

How to fix or mitigate CVE-2026-5464?

Within 24 hours: identify all WordPress installations using ExactMetrics plugin ≤9.1.2 via administrative inventory and disable the plugin immediately. Within 7 days: evaluate whether ExactMetrics is business-critical; if so, contact vendor support for an estimated patch timeline and implement temporary role restrictions to prevent Editor-level access to WordPress dashboard. Within 30 days: apply vendor-released patch when available, or migrate to an alternative Google Analytics integration solution if no patch timeline is provided by the vendor.

ExactMetrics CVE-2026-5464

EUVD-2026-25207 HIGH

Missing Authorization (CWE-862)

2026-04-23 Wordfence

GHSA-wx6x-8rvm-6rmr

RCE Google Authentication Bypass WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 14:37 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 10:31 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 10:00 euvd

EUVD-2026-25207

Analysis Generated

Apr 23, 2026 - 10:00 vuln.today

CVE Published

Apr 23, 2026 - 08:28 nvd

HIGH 7.2

DescriptionCVE.org

The ExactMetrics - Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation in all versions up to, and including, 9.1.2. This is due to the reports page exposing the 'onboarding_key' transient to any user with the 'exactmetrics_view_dashboard' capability. This key is the sole authorization gate for the '/wp-json/exactmetrics/v1/onboarding/connect-url' REST endpoint, which returns a one-time hash (OTH) token. This OTH token is then the only credential checked by the 'exactmetrics_connect_process' AJAX endpoint - which has no capability check, no nonce verification, and accepts an arbitrary plugin ZIP URL via the file parameter for installation and activation. This makes it possible for authenticated attackers, with Editor-level access and above granted the report viewing permission, to install and activate arbitrary plugins from attacker-controlled URLs, leading to Remote Code Execution.

AnalysisAI

Authenticated Editor-level attackers can achieve Remote Code Execution in ExactMetrics WordPress plugin (all versions ≤9.1.2) by chaining exposed onboarding credentials to install and activate arbitrary plugin ZIP files from attacker-controlled URLs. The attack exploits a missing authorization check in the 'exactmetrics_connect_process' AJAX endpoint that accepts the one-time hash token obtained via the exposed 'onboarding_key' transient-effectively bypassing plugin installation controls. EPSS and KEV status unknown; CVSS 7.2 reflects high-privilege requirement (PR:H) but direct path to RCE makes this a critical risk for multi-author WordPress sites where Editors have dashboard viewing permissions. Wordfence advisory and source code references confirm the vulnerability chain across three distinct code locations in versions through 9.1.1.

Technical ContextAI

This vulnerability exploits WordPress's role-based access control (RBAC) and plugin management system. ExactMetrics grants the 'exactmetrics_view_dashboard' capability to Editor-level users and above. The plugin's onboarding flow uses a two-token authentication pattern: (1) an 'onboarding_key' transient exposed in the reports page JavaScript, and (2) a one-time hash (OTH) token returned by the '/wp-json/exactmetrics/v1/onboarding/connect-url' REST endpoint. The critical flaw (CWE-862: Missing Authorization) occurs in 'exactmetrics_connect_process' AJAX handler at includes/connect.php line 219, which validates only the OTH token without capability checks or WordPress nonces, then processes arbitrary plugin installation via the 'file' parameter pointing to remote ZIP URLs. The vulnerability chain spans three code locations: admin-assets.php (exposing onboarding_key at line 932), class-exactmetrics-onboarding.php (REST endpoint at line 109), and connect.php (AJAX handler at line 27 and installation logic at line 219). Affected product per CPE: ExactMetrics (SMUB vendor) WordPress plugin versions through 9.1.2.

RemediationAI

Immediately upgrade ExactMetrics to version 9.1.3 or later if available (check WordPress plugin repository or vendor advisory for confirmed patched version-exact fix version not independently verified from provided references). Until patching: (1) Revoke 'exactmetrics_view_dashboard' capability from all Editor-level users who do not require analytics access, limiting exposure to Administrator-only (trade-off: reduces reporting functionality for content editors); (2) implement Web Application Firewall rules blocking POST requests to '/wp-admin/admin-ajax.php' with action parameter 'exactmetrics_connect_process' from non-Administrator IPs (trade-off: breaks legitimate onboarding workflow); (3) monitor WordPress plugin installation logs for unauthorized additions via file integrity monitoring focusing on wp-content/plugins directory writes from www-data user; (4) disable file modifications via wp-config.php constant 'define(DISALLOW_FILE_MODS, true);' to prevent all plugin/theme installations (trade-off: blocks legitimate updates requiring manual FTP-based patching). Reference Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/09127277-9e71-484d-b674-52af693c995b for latest remediation guidance and source code examination at WordPress plugin Trac browser for verification of patch implementation.