Improper Privilege Management in ExactMetrics Google Analytics Dashboard for WordPress Plugin

CVE-2026-1993

What is CVE-2026-1993?

The ExactMetrics Google Analytics Dashboard for WordPress plugin is susceptible to a vulnerability that allows authenticated attackers with specific capabilities to manipulate plugin settings. This occurs within the update_settings() function that does not properly validate allowed settings, enabling unauthorized users to modify critical configuration options. For instance, an attacker could alter the save_settings option to grant access rights to the plugin for user roles that shouldn't have permissions, like subscribers. This misuse can compromise site security by expanding administrative access inappropriately.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References