CVE-2026-8944 is a CSRF vulnerability in the engagementanalytics Plugin for Google Analytics by IO technologies for WordPress. The issue is due to missing or incorrect nonce validation on the ga.php settings page, which allows an attacker to forge requests that update the plugin's stored Google Analytics tracking ID option (io-ga-id). Exploitation requires tricking a site administrator into performing an action, such as clicking a crafted link. The vulnerability affects versions up to and including 1.1. No official patch or remediation level has been published at this time.

An attacker can cause an authenticated site administrator to unknowingly change the Google Analytics tracking ID stored by the plugin. This could lead to inaccurate analytics data or redirect analytics data to an attacker-controlled account. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links and consider limiting administrative access or using additional protections such as web application firewalls that can detect CSRF attempts.