QwikSec

Security Database

CVE

CWE

Training

CVE-2026-5371

Published: May 12, 2026

Modified: May 13, 2026

PUBLISHED

CVSS v3.1

7.1

HIGH

Description

The MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability checks on the get_ads_access_token() and reset_experience() functions in all versions up to, and including, 10.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve live Google OAuth access tokens and reset Plugins's Google Ads integration.

Vendor	Product	Versions
chriscct7	MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)	affected `0 - <= 10.1.2`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/5d380b66-675e-451d-a7e3-4efe1fbd08b2?source=cve

https://plugins.trac.wordpress.org/browser/google-analytics-for-wordpress/tags/10.0.3/includes/admin/admin-assets.php#L205

https://plugins.trac.wordpress.org/browser/google-analytics-for-wordpress/tags/10.0.3/includes/ppc/google/class-monsterinsights-google-ads.php#L167

https://plugins.trac.wordpress.org/browser/google-analytics-for-wordpress/tags/10.0.3/includes/ppc/google/class-monsterinsights-google-ads.php#L243

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.