CVE-2026-1993

The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to modify any plugin setting, including the `save_settings` option that controls which user roles have access to plugin functionality. The admin intended to delegate configuration access to a trusted user, not enable that user to delegate access to everyone. By setting `save_settings` to include `subscriber`, an attacker can grant plugin administrative access to all subscribers on the site.

• CWE-269

• https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/tags/7.15.3/includes/admin/routes.php#L201
• https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/trunk/includes/admin/routes.php#L201
• https://plugins.trac.wordpress.org/changeset/3473805/google-analytics-dashboard-for-wp/trunk/includes/admin/routes.php?old=3453934&old_path=google-analytics-dashboard-for-wp%2Ftrunk%2Fincludes%2Fadmin%2Froutes.php
• https://plugins.trac.wordpress.org/changeset/3473805/google-analytics-dashboard-for-wp/trunk/includes/capabilities.php?old=2897321&old_path=google-analytics-dashboard-for-wp%2Ftrunk%2Fincludes%2Fcapabilities.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1c1ce474-ecce-4d21-b174-cb54a2441b2b?source=cve

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1987The Scheduler Widget plugin for WordPress is vulnerable to I…5.4
• CVE-2026-1988The Flexi Product Slider and Grid for WooCommerce plugin for…7.5
• CVE-2026-1989Authorization bypass through User-Controlled key vulnerabili…7.5
• CVE-2026-1990A security vulnerability has been detected in oatpp up to 1.…3.3
• CVE-2026-1991A vulnerability was detected in libuvc up to 0.0.7. Affected…5.5
• CVE-2026-1992The ExactMetrics – Google Analytics Dashboard for WordPress …8.8
• CVE-2026-1994The s2Member plugin for WordPress is vulnerable to privilege…9.8
• CVE-2026-1995In versions before 7.0.0.64, IDrive’s id_service.exe process…7.8
• CVE-2026-1996Certain HP OfficeJet Pro printers may be vulnerable to poten…5.3
• CVE-2026-1997Certain HP OfficeJet Pro printers may expose information if …5.3
• CVE-2026-1998A flaw has been found in micropython up to 1.27.0. This vuln…5.5
• CVE-2026-1999An incorrect authorization vulnerability was identified in G…6.5