An authenticated authorization bypass in the ExactMetrics plugin for WordPress allows attackers with specific low-level permissions to achieve Remote Code Execution.

The vulnerability exists in the store_settings method of the ExactMetrics_Onboarding class, where a user-supplied triggered_by parameter is used to perform permission checks instead of the current user ID. This allows an authenticated attacker possessing the exactmetrics_save_settings capability to bypass required administrative checks to perform plugin installations.

The ability to perform arbitrary plugin installations grants an attacker the power to execute malicious code on the server, potentially leading to a full site takeover. Given the CVSS score of 8.8, this is a high-severity risk that could result in total data compromise, unauthorized administrative access, and significant operational disruption.

Immediate Action: Review vendor release notes for version 9.0.3 or higher to apply the necessary security patch; if a patch is not yet available, disable the plugin immediately.

Proactive Monitoring: Monitor WordPress administrative logs for unauthorized plugin installations or modifications performed by non-administrator user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing suspicious parameters directed at the ExactMetrics onboarding endpoints.

Public Exploit Available: No

This vulnerability presents a significant risk to WordPress environments that utilize the ExactMetrics plugin. Administrators must prioritize updating to the latest version as soon as the vendor makes it available, as the flaw allows for Remote Code Execution. Until a patch is applied, restrict access to the dashboard and audit user roles to ensure the principle of least privilege is strictly enforced.