| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2026-5464 | 23 Apr 202608:28 | – | attackerkb |
 | CVE-2026-5464 | 23 Apr 202611:16 | – | circl |
 | WordPress plugin ExactMetrics 安全漏洞 | 23 Apr 202600:00 | – | cnnvd |
 | CVE-2026-5464 ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process | 23 Apr 202608:28 | – | cvelist |
 | EUVD-2026-25207 | 23 Apr 202612:31 | – | euvd |
 | CVE-2026-5464 | 23 Apr 202610:16 | – | nvd |
 | WordPress ExactMetrics plugin <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process vulnerability | 23 Apr 202603:25 | – | patchstack |
 | PT-2026-34649 | 23 Apr 202600:00 | – | ptsecurity |
 | CVE-2026-5464 | 5 Jun 202619:19 | – | redhatcve |
 | CVE-2026-5464 ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process | 23 Apr 202608:28 | – | vulnrichment |
10
Node
smubexactmetrics_google_analytics_dashboard_for_wordpress_(website_stats_plugin)Range≤9.1.2wordpress
[
{
"vendor": "smub",
"product": "ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)",
"versions": [
{
"version": "0",
"status": "affected",
"lessThanOrEqual": "9.1.2",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| onboarding_key | path | wp-json/exactmetrics/v1/onboarding/connect-url | REST endpoint exposes onboarding_key gating token; provides a one-time hash token that is used to authorize the subsequent plugin installation/activation via AJAX. | CWE-862 |
| action | request body | wp-admin/admin-ajax.php | AJAX endpoint exactmetrics_connect_process accepts an arbitrary plugin ZIP URL via the file parameter and lacks capability/nonce checks, enabling installation/activation of plugins from attacker-controlled URLs. | CWE-862 |
| file | request body | wp-admin/admin-ajax.php | AJAX endpoint exactmetrics_connect_process accepts an arbitrary plugin ZIP URL via the file parameter and lacks capability/nonce checks, enabling installation/activation of plugins from attacker-controlled URLs. | CWE-862 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 10:59Current
5.8Medium risk
Vulners AI Score5.8
CVSS 3.17.2
EPSS0.00695
SSVC