PT-2026-67645 · WordPress · Monsterinsights
CVE-2026-11366
·
Published
2026-08-04
·
Updated
2026-08-04
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
MonsterInsights WordPress plugin versions prior to 11.1.0
Description
An issue exists where the software fails to correctly validate the signature on an unauthenticated AJAX action. When the plugin is not connected to Google Analytics, the HMAC (Hash-based Message Authentication Code) signing key remains empty. This allows unauthenticated attackers to forge a valid signature and overwrite a configuration value, which disrupts server-side analytics when operating in Manual GA4 mode.
Recommendations
Update MonsterInsights WordPress plugin to version 11.1.0 or later.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Monsterinsights