CVE-2026-1993: ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update

Vulnerability summary

CVE-2026-1993 is a high (CVSS 8.8) Improper Privilege Management vulnerability in smub exactmetrics – google analytics dashboard for wordpress (website stats plugin). EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities. Fixed in 9.0.3.

Timeline

1. 11-03-2026
   PublishedVulnerability first disclosed.
2. 11-03-2026
   Last modifiedVulnerability information updated.

Description

The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to modify any plugin setting, including the `save_settings` option that controls which user roles have access to plugin functionality. The admin intended to delegate configuration access to a trusted user, not enable that user to delegate access to everyone. By setting `save_settings` to include `subscriber`, an attacker can grant plugin administrative access to all subscribers on the site.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.