The ExactMetrics plugin for WordPress contains a critical vulnerability allowing authenticated users with specific permissions to perform unauthorized plugin installations and achieve Remote Code Execution.

The vulnerability stems from missing authorization and nonce verification in the plugin's REST and AJAX endpoints, specifically the onboarding connection process. Authenticated attackers with the 'exactmetrics_view_dashboard' capability can exploit this to install and activate arbitrary plugins from external sources.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the underlying WordPress server. Given the CVSS score of 7.2, this represents a high-severity risk that could lead to full site compromise, unauthorized data access, and potential lateral movement within the hosting environment.

Immediate Action: Review the official ExactMetrics changelog and update the plugin to the latest version immediately to ensure the vulnerable endpoints are properly secured.

Proactive Monitoring: Monitor server access logs for requests directed at /wp-json/exactmetrics/v1/onboarding/connect-url and activity involving unexpected plugin installations or activations.

Compensating Controls: If an update is not immediately available, restrict access to the WordPress administrative dashboard and disable the ExactMetrics plugin to prevent exploitation of the vulnerable REST and AJAX endpoints.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk to WordPress site integrity by allowing for unauthorized code execution. Administrators should prioritize updating the ExactMetrics plugin to a version beyond 9.1.2 as soon as it becomes available. If immediate updates are not feasible, deactivating the plugin is the most effective way to eliminate the attack surface until a patch is applied.