CVE-2026-1992

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1992", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-05T16:08:52.114Z", "datePublished": "2026-03-11T09:25:43.399Z", "dateUpdated": "2026-03-11T13:30:00.851Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-11T09:25:43.399Z"}, "affected": [{"vendor": "smub", "product": "ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)", "versions": [{"version": "8.0.0", "status": "affected", "lessThanOrEqual": "9.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ExactMetrics \u2013 Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is due to the `store_settings()` method in the `ExactMetrics_Onboarding` class accepting a user-supplied `triggered_by` parameter that is used instead of the current user's ID to check permissions. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to bypass the `install_plugins` capability check by specifying an administrator's user ID in the `triggered_by` parameter, allowing them to install arbitrary plugins and achieve Remote Code Execution. This vulnerability only affects sites on which administrator has given other user types the permission to view reports and can only be exploited by users of that type."}], "title": "ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/79b6b896-df66-4c3d-a4d4-d3dbeb630134?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/trunk/includes/admin/class-exactmetrics-onboarding.php#L273"}, {"url": "https://plugins.trac.wordpress.org/changeset/3473805/google-analytics-dashboard-for-wp/trunk/includes/admin/class-exactmetrics-onboarding.php?old=3309894&old_path=google-analytics-dashboard-for-wp%2Ftrunk%2Fincludes%2Fadmin%2Fclass-exactmetrics-onboarding.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ali S\u00fcnb\u00fcl"}], "timeline": [{"time": "2026-02-05T16:28:59.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-10T21:00:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T13:29:03.679877Z", "id": "CVE-2026-1992", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:30:00.851Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1992", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T13:29:03.679877Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:29:51.072Z"}}], "cna": {"title": "ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation", "credits": [{"lang": "en", "type": "finder", "value": "Ali S\u00fcnb\u00fcl"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "smub", "product": "ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "9.0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-05T16:28:59.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-10T21:00:15.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/79b6b896-df66-4c3d-a4d4-d3dbeb630134?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/trunk/includes/admin/class-exactmetrics-onboarding.php#L273"}, {"url": "https://plugins.trac.wordpress.org/changeset/3473805/google-analytics-dashboard-for-wp/trunk/includes/admin/class-exactmetrics-onboarding.php?old=3309894&old_path=google-analytics-dashboard-for-wp%2Ftrunk%2Fincludes%2Fadmin%2Fclass-exactmetrics-onboarding.php"}], "descriptions": [{"lang": "en", "value": "The ExactMetrics \u2013 Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is due to the `store_settings()` method in the `ExactMetrics_Onboarding` class accepting a user-supplied `triggered_by` parameter that is used instead of the current user's ID to check permissions. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to bypass the `install_plugins` capability check by specifying an administrator's user ID in the `triggered_by` parameter, allowing them to install arbitrary plugins and achieve Remote Code Execution. This vulnerability only affects sites on which administrator has given other user types the permission to view reports and can only be exploited by users of that type."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-11T09:25:43.399Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1992", "state": "PUBLISHED", "dateUpdated": "2026-03-11T13:30:00.851Z", "dateReserved": "2026-02-05T16:08:52.114Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-11T09:25:43.399Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)", "vendor": "smub", "versions": [{"lessThanOrEqual": "9.0.2", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ExactMetrics \u2013 Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is due to the `store_settings()` method in the `ExactMetrics_Onboarding` class accepting a user-supplied `triggered_by` parameter that is used instead of the current user's ID to check permissions. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to bypass the `install_plugins` capability check by specifying an administrator's user ID in the `triggered_by` parameter, allowing them to install arbitrary plugins and achieve Remote Code Execution. This vulnerability only affects sites on which administrator has given other user types the permission to view reports and can only be exploited by users of that type."}, {"lang": "es", "value": "El plugin ExactMetrics \u2013 Google Analytics Dashboard para WordPress es vulnerable a Referencia Directa Insegura a Objeto en las versiones 8.6.0 a 9.0.2. Esto se debe a que el m\u00e9todo 'store_settings()' en la clase 'ExactMetrics_Onboarding' acepta un par\u00e1metro 'triggered_by' proporcionado por el usuario que se utiliza en lugar del ID del usuario actual para verificar permisos. Esto hace posible que atacantes autenticados con la capacidad 'exactmetrics_save_settings' omitan la verificaci\u00f3n de capacidad 'install_plugins' al especificar el ID de usuario de un administrador en el par\u00e1metro 'triggered_by', permiti\u00e9ndoles instalar plugins arbitrarios y lograr la ejecuci\u00f3n remota de c\u00f3digo. Esta vulnerabilidad solo afecta a los sitios en los que el administrador ha otorgado a otros tipos de usuario el permiso para ver informes y solo puede ser explotada por usuarios de ese tipo."}], "id": "CVE-2026-1992", "lastModified": "2026-06-17T10:16:50.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1992", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T13:29:03.679877Z", "version": "2.0.3"}}]}, "published": "2026-03-11T10:16:13.280", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/trunk/includes/admin/class-exactmetrics-onboarding.php#L273"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3473805/google-analytics-dashboard-for-wp/trunk/includes/admin/class-exactmetrics-onboarding.php?old=3309894&old_path=google-analytics-dashboard-for-wp%2Ftrunk%2Fincludes%2Fadmin%2Fclass-exactmetrics-onboarding.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/79b6b896-df66-4c3d-a4d4-d3dbeb630134?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,9.0.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)", "source": "cna", "vendor": "smub"}, "product": "exactmetrics_\u2013_google_analytics_dashboard_for_wordpress_(website_stats_plugin)", "vendor": "smub"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T14:58:24.682038+00:00", "value": {"mitigation_remediation": ["Update the ExactMetrics plugin to the latest available release (e.g., version 9.0.3 or later).", "If an update is not immediately possible, remove the exactmetrics_save_settings capability from non-administrator roles to prevent privilege escalation.", "Restrict the ability to view reports to administrator roles only, eliminating the user types that can exploit the vulnerability.", "Audit and verify that user role capabilities have not been inadvertently broadened.", "Review server and file permissions to ensure that plugin installation directories are not writable by unauthorized users."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Vendors: smub \u2013 ExactMetrics \u2013 Google Analytics Dashboard for WordPress. Product: ExactMetrics plugin for WordPress. Affected versions: 8.6.0 through 9.0.2. Users who have been granted the exactmetrics_save_settings capability, typically those with permission to view reports, can exploit this flaw.", "description_and_impact": "The ExactMetrics \u2013 Google Analytics Dashboard for WordPress plugin is vulnerable to an Insecure Direct Object Reference (IDOR) from versions 8.6.0 to 9.0.2. The vulnerability stems from the store_settings() method in the ExactMetrics_Onboarding class, which accepts a user\u2011supplied \"triggered_by\" parameter. Instead of using the current user\u2019s ID, the method checks the supplied ID for the exactmetrics_save_settings capability, bypassing the install_plugins check. This flaw allows an authenticated attacker with the exactmetrics_save_settings capability to supply an administrator\u2019s user ID and install arbitrary plugins, granting the attacker Remote Code Execution on the site. Key detail from the CVE description: \u201callowing them to install arbitrary plugins and achieve Remote Code Execution.\u201d", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is less than 1%, suggesting a relatively low likelihood of exploitation at this time, and it is not listed in the CISA KEV catalog. Exploitation requires authentication; the attacker must possess the exactmetrics_save_settings capability and be able to specify an administrator\u2019s user ID in the triggered_by parameter. The attack vector is thus likely an authenticated internal attack via the plugin\u2019s settings interface, and the impact is potential Remote Code Execution and compromise of site integrity and confidentiality."}}}}, "created": "2026-03-12T10:06:09.170951+00:00", "updated": "2026-03-20T14:37:30.396360+00:00", "vendors": ["smub", "smub$PRODUCT$exactmetrics_\u2013_google_analytics_dashboard_for_wordpress_(website_stats_plugin)", "wordpress", "wordpress$PRODUCT$wordpress"]}