Aller au contenu
Se connecter
3.7 Faible

CVE-2026-11366 The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its…

Description

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.

Produits et versions touchés

Produit Versions touchées Corrigé en
MonsterInsights 11.1 premières → < 11.1.0 11.1.0

Autres CVE de MonsterInsights

Les 3 CVE de MonsterInsights →
CVE-2023-0081 The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before… 5.4 Moyenne CVE-2022-3904 The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages… 6.1 Moyenne
Suivre cette CVE