CVE-2026-11366 MonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass
Unauthenticated attackers can bypass HMAC validation when the analytics key is empty to modify plugin configuration, affecting WordPress sites using MonsterInsights.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11366?
CVE-2026-11366 is a low-severity authentication bypass vulnerability in Unknown MonsterInsights, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.
Weakness: CWE-287
Which versions are affected by CVE-2026-11366?
How do I fix CVE-2026-11366?
No fix has been published for CVE-2026-11366 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-11366 being exploited?
There is no known exploitation of CVE-2026-11366 in the wild and no public exploit code.
Sources
Also known as GHSA-9984-4442-697f.