Skip to content
Sign in
3.7 Low

CVE-2026-11366 The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its…

Description

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.

Affected products and versions

Product Affected versions Fixed in
MonsterInsights 11.1 earliest → < 11.1.0 11.1.0

Other CVEs of MonsterInsights

The 3 CVEs of MonsterInsights →
CVE-2023-0081 The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before… 5.4 Medium CVE-2022-3904 The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages… 6.1 Medium
Track this CVE