CVE-2026-5488

The ExactMetrics plugin for WordPress contains a security flaw in versions up to 9.1.2 that allows unauthorized access to sensitive features. Specifically, the get_ads_access_token() and reset_experience() functions within the plugin's AJAX handlers fail to verify user permissions, allowing attackers with subscriber-level access or higher to obtain valid Google Ads tokens and manipulate integration settings. This vulnerability can be exploited by authenticated users who should not have such privileges.

Based on public CVE data (MITRE/NVD).