Threats tagged 'ghsa-9984-4442-697f'

CVE-2026-11366 is a low-severity vulnerability in the MonsterInsights WordPress plugin versions before 11.1.0. It involves improper authentication due to incorrect validation of the signature on an unauthenticated AJAX action. When the plugin is not connected to Google Analytics, the HMAC signing key is empty, allowing unauthenticated attackers to forge a valid signature and overwrite a configuration value. This disrupts server-side analytics in Manual GA4 mode.