ExactMetrics WordPress Plugin CVE-2026-5464: Overview of Chained Authorization Bypass Leading to Remote Code Execution

Introduction

A chained authorization bypass in the ExactMetrics Google Analytics Dashboard for WordPress plugin lets authenticated users with Editor-level access install and activate arbitrary plugins from attacker-controlled URLs, which results in remote code execution. The plugin has over 300,000 active installations, which makes this vulnerability (CVE-2026-5464, CVSS 7.2) a meaningful risk for WordPress sites.

ExactMetrics is a widely used WordPress plugin that brings Google Analytics reporting into the WordPress admin dashboard. It simplifies analytics setup and shows traffic reports without making users leave their site's backend. That large install base makes it a notable target for attackers who want to compromise WordPress sites at scale.

Technical information

CVE-2026-5464 is classified under CWE-862 (Missing Authorization Check). The vulnerability is a chain of three weakly protected endpoints. Exploited in sequence, they take an attacker from a leaked transient value to full remote code execution.

Step 1: Reports page leaks the onboarding key

The chain starts at the ExactMetrics reports page, which any user with the exactmetrics_view_dashboard capability can open. The code in admin-assets.php (around line 932 in version 9.1.1) localizes data for the frontend JavaScript, and that data includes the onboarding_key transient. Any user with the dashboard viewing permission, including Editors who have been granted this capability, can read the transient from the page source or the JavaScript context.

The onboarding_key transient is the only authorization gate for the next step in the chain.

Step 2: REST endpoint exchanges the key for a One-Time Hash

With the leaked onboarding_key, the attacker sends a request to:

/wp-json/exactmetrics/v1/onboarding/connect-url

This route is registered in class-exactmetrics-onboarding.php (line 109 in version 9.1.1). Its permission callback only checks whether the provided key matches the stored transient. The endpoint performs no WordPress capability check at this stage. If the key matches, it returns a One-Time Hash (OTH) token.

Step 3: AJAX endpoint installs arbitrary plugins without authorization

The last link in the chain, and the most critical, is the exactmetrics_connect_process AJAX endpoint, defined in connect.php (lines 27 and 219 in version 9.1.1). It is registered with wp_ajax_nopriv_exactmetrics_connect_process, so it is reachable without standard WordPress authentication. The function:

1. Checks only the OTH token obtained in Step 2
2. Performs no capability check
3. Performs no nonce verification
4. Accepts an arbitrary plugin ZIP URL via the file parameter
5. Passes that URL directly to the WordPress plugin installer, which installs and activates it

Endpoint authorization summary

The whole authorization model collapses for two reasons. The transient key is exposed to users who should not have access to the onboarding flow, and the downstream endpoints treat possession of the key (and then the OTH token) as enough proof of authorization. WordPress plugins execute PHP code, so installing a malicious plugin ZIP from an attacker-controlled URL is remote code execution.

Attack flow summary

1. Attacker authenticates as an Editor (or higher) with the exactmetrics_view_dashboard capability.
2. Attacker visits the ExactMetrics reports page and extracts the onboarding_key transient from the localized JavaScript data.
3. Attacker sends a request to /wp-json/exactmetrics/v1/onboarding/connect-url with the leaked key and receives an OTH token in response.
4. Attacker calls admin-ajax.php?action=exactmetrics_connect_process with the OTH token and a file parameter pointing to a malicious plugin ZIP hosted on an attacker-controlled server.
5. WordPress installs and activates the malicious plugin, which executes the attacker's PHP code on the server.

Affected systems and versions

All versions of the ExactMetrics Google Analytics Dashboard for WordPress plugin up to and including version 9.1.2 are affected. Exploitation requires:

• An authenticated user account with at least Editor-level privileges
• The exactmetrics_view_dashboard capability granted to that user (a plugin-specific capability that can be assigned to non-Administrator roles)

The vendor has released version 9.1.3 to fix this vulnerability.

References

• NVD Entry for CVE-2026-5464
• Wordfence Threat Intelligence Advisory
• Wordfence Vulnerability Detail Page
• ExactMetrics Plugin on WordPress.org
• Source: admin-assets.php (v9.1.1, line 932)
• Source: class-exactmetrics-onboarding.php (v9.1.1, line 109)
• Source: connect.php (v9.1.1, line 219)
• Source: connect.php (v9.1.1, line 27)