Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to modify any plugin setting, including the `save_settings` option that controls which user roles have access to plugin functionality. The admin intended to delegate configuration access to a trusted user, not enable that user to delegate access to everyone. By setting `save_settings` to include `subscriber`, an attacker can grant plugin administrative access to all subscribers on the site.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-11 | 3 | Disclosure3 |
| 2026-03-12 | 1 | General1 |
| 2026-03-15 | 1 | Disclosure1 |
CVE-2026-1993 The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `u… https://www.cve.org/CVERecord?id=CVE-2026-1993
Post summary
A new CVE for the ExactMetrics WordPress plugin is announced, detailing improper privilege management in specific versions, with no PoC, exploit, or patch information available.
CVE Alert: CVE-2026-1993 - smub - ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) - https://www.redpacketsecurity.com/cve-alert-cve-2026-1993-smub-exactmetrics-google-analytics-dashboard-for-wordpress-website-stats-plugin/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-1993 #smub #exactmetrics-google-analytics-dashboard-for-wordpress-website-stats-plugin
Post summary
The post issues a CVE alert for CVE‑2026‑1993 affecting the ExactMetrics WordPress plugin and directs readers to an external link for more information.
🟠 CVE-2026-1993 - High The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` func... https://www.thehackerwire.com/vulnerability/CVE-2026-1993/ https://t.co/POF4IbU1xG
Post summary
The tweet details a high‑severity vulnerability in ExactMetrics—specifying affected versions and a critical function—without mentioning a PoC, exploit, or patch.
CVE-2026-1993 Privilege Escalation in ExactMetrics WordPress Plugin via Unauthorized Settings Modification https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1993
Post summary
The CVE identifies a privilege escalation flaw in the ExactMetrics WordPress plugin that allows unauthorized modification of settings.
[CVE-2026-1993: HIGH] ExactMetrics – Google Analytics Dashboard for WordPress plugin version 7.1.0 to 9.0.2 has an Improper Privilege Management vulnerability enabling attackers to modify plugin settings, incl...#cve,CVE-2026-1993,#cybersecurity https://cvefind.com/CVE-2026-1993
Post summary
The post announces that ExactMetrics plugin versions 7.1.0–9.0.2 are vulnerable to an Implicit Privilege Management flaw that lets attackers alter plugin settings; no PoC, exploit, or patch details are provided.