CVE-2026-11366
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The MonsterInsights WordPress plugin before version 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions. When the plugin is not connected to Google Analytics, the HMAC signing key is empty, allowing unauthenticated attackers to forge a valid signature and overwrite a configuration value, disrupting server-side analytics in Manual GA4 mode.
Risk Assessment
An unauthenticated attacker can alter plugin configuration, potentially disrupting analytics and enabling further manipulation.
Recommendation
Update the MonsterInsights plugin to version 11.1.0 or later, which includes the fix.
Original NVD description (English source)
The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.