What is the CVSS score of EUVD-2026-25393?

EUVD-2026-25393 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

ExactMetrics WordPress Plugin EUVD-2026-25393

| CVE-2026-5488 MEDIUM

Missing Authorization (CWE-862)

2026-04-24 Wordfence

GHSA-36m8-qf73-626j

PHP Google Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 24, 2026 - 04:31 vuln.today

EUVD ID Assigned

Apr 24, 2026 - 04:00 euvd

EUVD-2026-25393

Analysis Generated

Apr 24, 2026 - 04:00 vuln.today

CVE Published

Apr 24, 2026 - 03:27 nvd

MEDIUM 5.3

DescriptionCVE.org

The ExactMetrics - Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin pages (including profile.php which subscribers can access), and while other similar AJAX endpoints in the same class properly check for the exactmetrics_save_settings capability, these two endpoints only verify the nonce. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve valid Google Ads access tokens and reset Google Ads integration settings.

AnalysisAI

ExactMetrics Google Analytics Dashboard for WordPress versions up to 9.1.2 allow authenticated subscribers to retrieve Google Ads access tokens and reset Google Ads integration settings through missing authorization checks in AJAX handlers. Although a nonce is verified, two AJAX endpoints (get_ads_access_token and reset_experience) lack the capability checks present in similar endpoints, enabling attackers with subscriber-level access to perform administrative actions. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects network-accessible unauthenticated exploitation, but the description indicates authenticated subscriber access is required, creating a discrepancy between reported CVSS and actual attack prerequisites.

Technical ContextAI

ExactMetrics integrates Google Analytics and Google Ads functionality into WordPress via AJAX handlers in the class-exactmetrics-google-ads.php component. The vulnerability exploits a capability check bypass in two AJAX endpoints (get_ads_access_token and reset_experience) that perform authorization via nonce verification alone. The nonce (mi-admin-nonce) is localized on all admin pages, including profile.php, which WordPress subscribers can access by default. While peer AJAX endpoints in the same class properly implement the exactmetrics_save_settings capability check (a WordPress-specific authorization mechanism restricting actions to users with explicit administrative permissions), these two handlers omit this critical step. This creates a privilege escalation vector where subscriber-level users can invoke administrative functionality. The CWE-862 classification (Missing Authorization) identifies the root cause as inadequate access control enforcement at the application logic layer.

RemediationAI

Update ExactMetrics to version 9.1.3 or later, which adds capability checks to the get_ads_access_token() and reset_experience() AJAX handlers. WordPress administrators should navigate to Plugins → Installed Plugins and click Update immediately for this plugin. If immediate patching is not possible, restrict subscriber access on multi-author sites to trusted users only via WordPress user role management (Settings → Users → Edit roles), or use security plugins to block unauthenticated AJAX requests to exactmetrics endpoints. However, the latter does not address authenticated subscriber exploitation-patching is the definitive remediation. No vendor-provided temporary workaround configuration options exist to disable these specific endpoints without code modification. Site administrators managing Google Ads accounts should audit recent token access logs in Google Ads console and reset access credentials if subscriber account compromise is suspected.