PT-2026-24656 · Smub · Exactmetrics – Google Analytics Dashboard For Wordpress

Ali Sünbül · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-1993

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ExactMetrics – Google Analytics Dashboard for WordPress versions 7.1.0 through 9.0.2

Description The ExactMetrics – Google Analytics Dashboard for WordPress plugin exhibits an Improper Privilege Management issue. The update settings() function does not validate input, allowing authenticated attackers possessing the exactmetrics save settings capability to modify any plugin setting. Specifically, attackers can alter the save settings option, which governs user role access to plugin functionality. By modifying this setting to include the subscriber role, an attacker can grant administrative access to all subscribers on the site. The update settings() function is the component responsible for this behavior.

Recommendations Versions 7.1.0 through 9.0.2 are affected and should be updated when a fix is available. As a temporary workaround, restrict the exactmetrics save settings capability to only trusted users.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-1993

Affected Products

Exactmetrics – Google Analytics Dashboard For Wordpress

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-1993 · Security Note
• https://twitter.com/CVEnew/status/2033194307520545153 · Twitter Post
• https://t.me/cveNotify/155070 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1c1ce474-ecce-4d21-b174-cb54a2441b2b?source=cve · Note
• https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/trunk/includes/admin/routes.php#L201 · Note
• https://plugins.trac.wordpress.org/changeset/3473805/google-analytics-dashboard-for-wp/trunk/includes/capabilities.php?old=2897321&old_path=google-analytics-dashboard-for-wp%2Ftrunk%2Fincludes%2Fcapabilities.php · Note
• https://plugins.trac.wordpress.org/changeset/3473805/google-analytics-dashboard-for-wp/trunk/includes/admin/routes.php?old=3453934&old_path=google-analytics-dashboard-for-wp%2Ftrunk%2Fincludes%2Fadmin%2Froutes.php · Note
• https://t.me/CVEtracker/47117 · Telegram Post
• https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/tags/7.15.3/includes/admin/routes.php#L201 · Note
• https://twitter.com/TheHackerWire/status/2031752521702908138 · Twitter Post
• https://twitter.com/CveFindCom/status/2031681965292695593 · Twitter Post
• https://twitter.com/RedPacketSec/status/2031894860228173907 · Twitter Post