MonsterInsights EUVD-2026-29886

Requires an authenticated WordPress account with Subscriber-level access or above (PR:L) on a site running MonsterInsights ≤10.1.2, and the request must target the specific get_ads_access_token() or reset_experience() functions. For the token-disclosure impact to be meaningful, the site must have an active Google Ads/PPC integration configured so that an OAuth access token actually exists to be retrieved. Limiting factors: exploitation is impossible for fully unauthenticated visitors, so sites that disable open registration and restrict account creation substantially reduce risk; no user interaction or non-default configuration of the AJAX layer is otherwise needed, and the flaw is reachable remotely over the network.

Signals are internally consistent and point to a real but non-critical, integrity/confidentiality-of-secrets issue rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N, 7.1 High) matches the description: network-reachable, low complexity, requires only a low-privilege authenticated account, high confidentiality impact (live OAuth token disclosure) and limited integrity impact (integration reset). EPSS is very low at 0.03% (8th percentile), the CVE is NOT on CISA KEV, and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - so this is not currently weaponized or auto-exploitable at scale. The main caveat is the PR:L prerequisite: exploitation requires an existing Subscriber+ account, which is common on membership/e-commerce/multi-author sites that allow open registration but is a genuine barrier on locked-down sites. There is no conflicting data among sources; the primary real-world risk is credential/token theft enabling downstream access to a linked Google Ads account, which raises the practical impact above what the on-site A:N/I:L metrics alone suggest.

An attacker registers or obtains a Subscriber account on a WordPress site running MonsterInsights ≤10.1.2, then sends an authenticated request invoking the get_ads_access_token() handler and receives the site's live Google OAuth access token in the response. With that token they access the connected Google Ads account outside WordPress, and can separately call reset_experience() to break the site's Ads integration. No public proof-of-concept has been identified at time of analysis, but the low attack complexity makes exploitation straightforward for anyone with a foothold account.