Vulnerability · Published May 12, 2026 · Assigned by Wordfence

CVE-2026-5371MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset

High 7.1

In plain English

A high-severity missing authorization in MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) from chriscct7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 71.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability checks on the get_ads_access_token() and reset_experience() functions in all versions up to, and including, 10.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve live Google OAuth access tokens and reset Plugins's Google Ads integration.

Affected products (as reported)

Vendor	Product	Versions
chriscct7	MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)	0 – through 10.1.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

In plain English

Official description

Affected products (as reported)

References