Monsterinsights Google Analytics Dashboard For Wordpress Website Stats Made Easy
Monthly
Broken access control in the MonsterInsights Google Analytics plugin for WordPress (versions up to and including 10.1.2) lets any authenticated user with Subscriber-level access or higher call the unprotected get_ads_access_token() and reset_experience() functions, exposing live Google OAuth access tokens and letting them reset the plugin's Google Ads integration. The disclosed OAuth tokens can be abused to access the linked Google Ads/Analytics account outside WordPress, while the reset function disrupts the site's advertising integration. No public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with SSVC exploitation status of 'none'.
Broken access control in the MonsterInsights Google Analytics plugin for WordPress (versions up to and including 10.1.2) lets any authenticated user with Subscriber-level access or higher call the unprotected get_ads_access_token() and reset_experience() functions, exposing live Google OAuth access tokens and letting them reset the plugin's Google Ads integration. The disclosed OAuth tokens can be abused to access the linked Google Ads/Analytics account outside WordPress, while the reset function disrupts the site's advertising integration. No public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with SSVC exploitation status of 'none'.