此页面尚未翻译为您的语言。我们正在努力翻译，目前显示英文内容。
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-5371: Unauthorized Access in MonsterInsights WordPress Plugin
平台
wordpress
组件
google-analytics-for-wordpress
修复版本
10.1.3
CVE-2026-5371 is a vulnerability affecting the MonsterInsights WordPress plugin, a popular tool for Google Analytics integration. This flaw allows authenticated attackers, even those with Subscriber-level access, to retrieve live Google OAuth access tokens and manipulate the plugin's Google Ads integration. The vulnerability exists in versions up to 10.1.2 and has been resolved in version 10.1.3, released on May 12, 2026.
检测此 CVE 是否影响你的项目
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
影响与攻击场景翻译中…
The primary impact of CVE-2026-5371 is the unauthorized access and potential misuse of Google OAuth access tokens. An attacker who exploits this vulnerability could gain access to sensitive data associated with the website's Google Analytics and Google Ads accounts. This could include user data, campaign performance metrics, and potentially even billing information. The ability to reset the Google Ads integration further amplifies the impact, allowing an attacker to disrupt advertising campaigns and potentially redirect funds. While the vulnerability requires authentication, the low access level needed (Subscriber) significantly broadens the attack surface.
利用背景翻译中…
The vulnerability was published on May 12, 2026. No public exploits or proof-of-concept code have been observed at the time of writing. The CVSS score of 7.1 (HIGH) indicates a significant risk, and the ease of exploitation (requiring only Subscriber-level access) suggests that it could become a target for opportunistic attackers. The vulnerability is not currently listed on KEV or EPSS, but its potential impact warrants close monitoring.
威胁情报
漏洞利用状态
EPSS
0.03% (8% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 低 — 任何有效用户账户均可。
- User Interaction
- 无 — 攻击自动且无声，受害者无需任何操作。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 高 — 完全丧失机密性，攻击者可读取所有数据。
- Integrity
- 低 — 攻击者可修改部分数据，影响有限。
- Availability
- 无 — 无可用性影响。
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2026-5371 is to immediately upgrade the MonsterInsights plugin to version 10.1.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the getadsaccesstoken() and resetexperience() functions. While not a complete fix, this can limit the attacker's ability to exploit the vulnerability. Review WordPress user roles and permissions to ensure that only necessary users have access. Monitor WordPress logs for suspicious activity related to Google OAuth authentication. After upgrading, confirm the fix by attempting to access the Google Ads integration with a Subscriber-level user account and verifying that access is denied.
修复方法
更新至 10.1.3 版本，或更新的补丁版本
常见问题翻译中…
What is CVE-2026-5371 — Unauthorized Access in MonsterInsights WordPress Plugin?
CVE-2026-5371 is a HIGH severity vulnerability in the MonsterInsights WordPress plugin that allows authenticated subscribers to retrieve Google OAuth tokens and reset Google Ads integration, potentially leading to data exposure and campaign disruption.
Am I affected by CVE-2026-5371 in MonsterInsights WordPress Plugin?
You are affected if you are using the MonsterInsights plugin in WordPress versions 10.1.2 or earlier. Check your plugin version and upgrade immediately if necessary.
How do I fix CVE-2026-5371 in MonsterInsights WordPress Plugin?
Upgrade the MonsterInsights plugin to version 10.1.3 or later. If immediate upgrade is not possible, temporarily restrict access to the vulnerable functions and review user permissions.
Is CVE-2026-5371 being actively exploited?
No public exploits have been observed at this time, but the vulnerability's ease of exploitation and potential impact suggest it could become a target. Continuous monitoring is recommended.
Where can I find the official MonsterInsights advisory for CVE-2026-5371?
Refer to the official MonsterInsights website and WordPress plugin repository for the latest security advisories and updates related to CVE-2026-5371.
检测此 CVE 是否影响你的项目
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
立即扫描您的WordPress项目 — 无需账户
上传任何清单文件 (composer.lock, package-lock.json, WordPress 插件列表…) 或粘贴您的组件列表。您立即获得一份漏洞报告。上传文件只是开始：拥有账户后，您将获得持续监控、Slack/电子邮件警报、多项目和白标报告。
拖放您的依赖文件
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...