The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to an Insecure Direct Object Reference (IDOR) from versions 8.6.0 to 9.0.2. The vulnerability stems from the store_settings() method in the ExactMetrics_Onboarding class, which accepts a user‑supplied "triggered_by" parameter. Instead of using the current user’s ID, the method checks the supplied ID for the exactmetrics_save_settings capability, bypassing the install_plugins check. This flaw allows an authenticated attacker with the exactmetrics_save_settings capability to supply an administrator’s user ID and install arbitrary plugins, granting the attacker Remote Code Execution on the site. Key detail from the CVE description: “allowing them to install arbitrary plugins and achieve Remote Code Execution.”

Vendors: smub – ExactMetrics – Google Analytics Dashboard for WordPress. Product: ExactMetrics plugin for WordPress. Affected versions: 8.6.0 through 9.0.2. Users who have been granted the exactmetrics_save_settings capability, typically those with permission to view reports, can exploit this flaw.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is less than 1%, suggesting a relatively low likelihood of exploitation at this time, and it is not listed in the CISA KEV catalog. Exploitation requires authentication; the attacker must possess the exactmetrics_save_settings capability and be able to specify an administrator’s user ID in the triggered_by parameter. The attack vector is thus likely an authenticated internal attack via the plugin’s settings interface, and the impact is potential Remote Code Execution and compromise of site integrity and confidentiality.