CVE-2026-1993
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2.
Published Mar 11, 2026 · updated Jun 17, 2026
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the capability to modify any plugin setting, including the option that controls which user roles have access to plugin functionality. The admin intended to delegate configuration access to a trusted user, not enable that user to delegate access to everyone. By setting to include , an attacker can grant plugin administrative access to all subscribers on the site.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 11, 2026 · NIST NVD
Detected
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the capability to modify any plugin setting, including the option that controls which u
Jun 17, 2026 · NIST NVD
Updated
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the capability to modify any plugin setting, including the option that controls which u
Sources
- CVE.orgVulnerability recordCVE-2026-1993
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-1993
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the function accepting arbitrary plugin setting names without a whitelist of allowed settings. Thi
nvd.nist.gov