CVE-2026-1993

The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to modify any plugin setting, including the `save_settings` option that controls which user roles have access to plugin functionality. The admin intended to delegate configuration access to a trusted user, not enable that user to delegate access to everyone. By setting `save_settings` to include `subscriber`, an attacker can grant plugin administrative access to all subscribers on the site.

• CWE-269

• https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/tags/7.15.3/includes/admin/routes.php#L201
• https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/trunk/includes/admin/routes.php#L201
• https://plugins.trac.wordpress.org/changeset/3473805/google-analytics-dashboard-for-wp/trunk/includes/admin/routes.php?old=3453934&old_path=google-analytics-dashboard-for-wp%2Ftrunk%2Fincludes%2Fadmin%2Froutes.php
• https://plugins.trac.wordpress.org/changeset/3473805/google-analytics-dashboard-for-wp/trunk/includes/capabilities.php?old=2897321&old_path=google-analytics-dashboard-for-wp%2Ftrunk%2Fincludes%2Fcapabilities.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1c1ce474-ecce-4d21-b174-cb54a2441b2b?source=cve

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19924A security vulnerability has been detected in Tenda AC10 16.…9.8
• CVE-2026-19925A vulnerability was detected in SourceCodester Stock Managem…4.7
• CVE-2026-19926A vulnerability has been found in Evergreen up to 3.14.11/3.…7.3
• CVE-2026-19927A vulnerability was found in OpenBoxes up to 0.9.7. The impa…6.3
• CVE-2026-19928A vulnerability was determined in OpenBoxes up to 0.9.7. Thi…6.3
• CVE-2026-19929A vulnerability was identified in OpenBoxes up to 0.9.6. Thi…6.3
• CVE-2026-19930A security flaw has been discovered in Dolibarr up to 23.0.3…6.3
• CVE-2026-19931A flaw in libcurl makes it wrongly reuse an HTTP connection …9.8
• CVE-2026-19932A security flaw has been discovered in DefaultFuction Notice…6.3
• CVE-2026-19933A weakness has been identified in DefaultFuction Customer-Re…6.3
• CVE-2026-19934A vulnerability has been found in itsourcecode Hospital Mana…6.3
• CVE-2026-1994The s2Member plugin for WordPress is vulnerable to privilege…9.8