A critical privilege management flaw in the ExactMetrics WordPress plugin allows authenticated users to gain unauthorized administrative control over plugin settings.

The vulnerability exists in the update_settings() function, which fails to properly whitelist configuration parameters. An authenticated attacker with the exactmetrics_save_settings capability can modify plugin settings, specifically the save_settings option, to grant administrative access to lower-privileged roles such as subscribers.

Successful exploitation of this vulnerability could lead to a complete compromise of the plugin configuration, potentially allowing unauthorized users to gain administrative control over the site's analytics and associated data. With a CVSS score of 8.8, this represents a high-severity risk that could lead to unauthorized data access, configuration tampering, and significant reputational damage.

Immediate Action: Since no specific patch version is confirmed in the provided data, administrators should immediately audit user roles and disable or deactivate the ExactMetrics plugin until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review WordPress access and activity logs for unusual configuration changes, specifically monitoring for modifications to plugin settings or unexpected role escalations.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized requests to the update_settings() administrative endpoint associated with the plugin.

Public Exploit Available: No.

Given the high CVSS score and the nature of the privilege escalation, organizations must treat this vulnerability with urgency. Administrators should prioritize deactivating the affected plugin and restricting access to administrative functions until an official, verified patch is deployed to remediate the insecure update_settings() implementation.