The ExactMetrics WordPress plugin contains a missing authorization check in two AJAX handlers, allowing any authenticated user with a subscriber role or higher to retrieve valid Google Ads access tokens and reset integration settings. An attacker could obtain these tokens, potentially granting them access to the victim’s Google Ads account or enabling further exploitation if additional privileges are available. The vulnerability does not provide remote code execution or denial‑of‑service; it is an improper authorization flaw that exposes sensitive credentials and configuration, classified as CWE‑862.

This weakness exists in the ExactMetrics – Google Analytics Dashboard for WordPress plugin for all WordPress sites running versions up to and including 9.1.2. Users of the plugin with subscriber or higher roles are impacted because the AJAX endpoints do not enforce the required capability checks.

The CVSS score of 5.3 points to a moderate risk level, but the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The likely attack vector is via authenticated access: an attacker needs a valid subscriber or higher user account to send the vulnerable AJAX request. Given that access tokens are extracted over HTTP(S) with JSON responses, any intercepted traffic could lead to credential theft. Even though the vulnerability is limited to users who can log in, it still represents a significant privilege escalation within the site’s ecosystem and should be addressed promptly.