CVE-2026-5464

The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation in all versions up to, and including, 9.1.2. This is due to the reports page exposing the 'onboarding_key' transient to any user with the 'exactmetrics_view_dashboard' capability. This key is the sole authorization gate for the '/wp-json/exactmetrics/v1/onboarding/connect-url' REST endpoint, which returns a one-time hash (OTH) token. This OTH token is then the only credential checked by the 'exactmetrics_connect_process' AJAX endpoint — which has no capability check, no nonce verification, and accepts an arbitrary plugin ZIP URL via the file parameter for installation and activation. This makes it possible for authenticated attackers, with Editor-level access and above granted the report viewing permission, to install and activate arbitrary plugins from attacker-controlled URLs, leading to Remote Code Execution.

• CWE-862

• https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/tags/9.1.1/includes/admin/admin-assets.php#L932
• https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/tags/9.1.1/includes/admin/class-exactmetrics-onboarding.php#L109
• https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/tags/9.1.1/includes/connect.php#L219
• https://plugins.trac.wordpress.org/browser/google-analytics-dashboard-for-wp/tags/9.1.1/includes/connect.php#L27
• https://www.wordfence.com/threat-intel/vulnerabilities/id/09127277-9e71-484d-b674-52af693c995b?source=cve

Published

Apr 23, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54634Hamlib is a ham radio control library for radios, rotators, …7.3
• CVE-2026-54635pytonapi is a Python SDK for TONAPI that provides REST API, …7.5
• CVE-2026-54636Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron pl…9.9
• CVE-2026-54637Dragonfly is an open source P2P-based file distribution and …5.5
• CVE-2026-54638gotd/td is a T Telegram MTProto API client in Go. Prior to 0…7.5
• CVE-2026-54639Style Dictionary, a build system for creating cross-platform…8.8
• CVE-2026-54642CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.3
• CVE-2026-54643CubeCart is an ecommerce software solution. Prior to 6.7.5, …5.4
• CVE-2026-54644CubeCart is an ecommerce software solution. Prior to 6.7.5, …6.1
• CVE-2026-54645CubeCart is an ecommerce software solution. Prior to 6.7.5, …4.8
• CVE-2026-54646CubeCart is an ecommerce software solution. Prior to 6.7.5, …7.2
• CVE-2026-54647CubeCart is an ecommerce software solution. Prior to 6.7.5, …7.2