CVE-2026-5464: 
WordPress vulnerability analysis and mitigation

CVE-2026-5464 is a Missing Authorization vulnerability in the ExactMetrics – Google Analytics Dashboard for WordPress plugin that allows authenticated attackers with Editor-level access to install and activate arbitrary plugins from attacker-controlled URLs, leading to Remote Code Execution. All versions up to and including 9.1.2 are affected. The vulnerability was published on April 23, 2026, with a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The root cause is CWE-862 (Missing Authorization), stemming from a multi-step authorization chain failure. The plugin's reports page exposes the onboarding_key transient to any user with the exactmetrics_view_dashboard capability; this key is the sole authorization gate for the /wp-json/exactmetrics/v1/onboarding/connect-url REST endpoint, which returns a one-time hash (OTH) token. The exactmetrics_connect_process AJAX endpoint then accepts this OTH token as its only credential — with no capability check, no nonce verification — and accepts an arbitrary plugin ZIP URL via the file parameter for installation and activation. Relevant vulnerable code paths are documented in the plugin source at includes/admin/admin-assets.php#L932, includes/admin/class-exactmetrics-onboarding.php#L109, and includes/connect.php (GitHub Advisory).

Successful exploitation allows an authenticated attacker with Editor-level access (or above) who has been granted the exactmetrics_view_dashboard capability to install and activate a malicious plugin from an attacker-controlled URL, achieving Remote Code Execution on the WordPress server. This can result in full compromise of the WordPress installation — including complete confidentiality, integrity, and availability loss — enabling data exfiltration, web shell deployment, lateral movement within the hosting environment, and persistent backdoor access (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.23–0.26%, placing it in the 49th percentile for exploitation probability within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Editor-level access and the exactmetrics_view_dashboard capability, which limits opportunistic exploitation but remains a realistic insider or compromised-account threat vector.

1. Reconnaissance: Identify WordPress sites running ExactMetrics plugin version ≤ 9.1.2 using tools like WPScan or Shodan, and obtain or compromise an account with Editor-level access and the exactmetrics_view_dashboard capability.
2. Retrieve the onboarding key: Access the ExactMetrics reports page as the authenticated Editor user; extract the onboarding_key transient value exposed in the page source or via the dashboard interface.
3. Obtain the OTH token: Send an authenticated GET request to /wp-json/exactmetrics/v1/onboarding/connect-url using the onboarding_key as the authorization parameter; the endpoint returns a one-time hash (OTH) token.
4. Prepare malicious plugin: Create a malicious WordPress plugin ZIP file containing a PHP web shell or reverse shell payload, and host it at an attacker-controlled URL (e.g., https://attacker.com/malicious-plugin.zip).
5. Trigger arbitrary plugin installation: Send a POST request to the exactmetrics_connect_process AJAX endpoint (e.g., wp-admin/admin-ajax.php?action=exactmetrics_connect_process) with the OTH token and the file parameter set to the attacker-controlled ZIP URL — no nonce or capability check is enforced.
6. Achieve Remote Code Execution: The malicious plugin is installed and activated automatically; access the deployed web shell or trigger the reverse shell to gain code execution with the privileges of the WordPress application user (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the web server to unknown external URLs for plugin ZIP file downloads; unusual REST API calls to /wp-json/exactmetrics/v1/onboarding/connect-url from Editor-level accounts.
• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php with action=exactmetrics_connect_process; access log entries for the onboarding REST endpoint from non-administrative users.
• File System: Unexpected or newly created plugin directories under wp-content/plugins/; PHP files with obfuscated code, web shell patterns (eval, base64_decode, system, exec), or reverse shell payloads in the plugin directory.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) indicating post-exploitation activity.

Update the ExactMetrics plugin immediately to a version newer than 9.1.2, which addresses the missing authorization controls (GitHub Advisory). As an interim workaround, restrict the exactmetrics_view_dashboard capability to only highly trusted users who absolutely require dashboard access, minimizing the pool of accounts that can trigger the vulnerable endpoint. Conduct a security audit of the WordPress installation to identify any unauthorized plugins that may have been installed, and monitor the wp-content/plugins/ directory for unexpected additions. Qualys scanner detection ID 531269 can be used to identify vulnerable instances.

Wordfence included CVE-2026-5464 in their weekly WordPress vulnerability report for April 20–26, 2026, and maintains a dedicated threat intelligence entry for this vulnerability (Wordfence Blog). RedPacket Security flagged the vulnerability via their CVE alert service and Mastodon social media channel shortly after disclosure. The vulnerability was also picked up by INCIBE-CERT and CCN-CERT (Spain's national cybersecurity agencies), indicating broader European security community awareness.