MonsterInsights Google Analytics Dashboard for WordPress Missing Authorization Vulnerability

A vulnerability exists in the MonsterInsights Google Analytics Dashboard for WordPress plugin, specifically in versions through 10.1.2. The issue arises from missing capability checks in the get_ads_access_token() and reset_experience() functions. This flaw allows authenticated attackers with Subscriber-level access and above to access live Google OAuth tokens and reset the plugin's Google Ads integration.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, specifically Google OAuth access tokens, and unauthorized modifications to the plugin's Google Ads integration.

Remediation

Users are advised to update the MonsterInsights Google Analytics Dashboard for WordPress plugin to version 10.1.3 or a newer patched version.