CVE-2026-8944 describes a Cross-Site Request Forgery vulnerability in the engagementanalytics Plugin for Google Analytics by IO technologies for WordPress. The issue arises from missing or incorrect nonce validation on the Google Analytics settings page (ga.php), which enables an attacker to forge requests that update the plugin's stored Google Analytics tracking ID option (io-ga-id). Exploitation requires tricking an authenticated site administrator into executing the malicious request. The vulnerability affects all plugin versions up to and including 1.1. No vendor advisory or patch information is currently available.

An attacker can cause an authenticated administrator to unknowingly update the Google Analytics tracking ID stored by the plugin. This could lead to inaccurate analytics data or redirect analytics tracking to an attacker-controlled account. The vulnerability does not impact confidentiality or availability, only the integrity of the tracking ID setting. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into the WordPress admin interface and consider restricting access to the plugin settings page. Monitoring for plugin updates from the vendor is recommended.