What is the CVSS score of CVE-2026-11366?

CVE-2026-11366 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-11366?

Yes, a public proof-of-concept exploit is available for CVE-2026-11366. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-11366?

Yes, a patch is available for CVE-2026-11366. Update the affected software to the latest version immediately.

MonsterInsights CVE-2026-11366

EUVD-2026-52582 LOW

Improper Authentication (CWE-287)

2026-08-04 WPScan

GHSA-9984-4442-697f

WordPress Authentication Bypass Google Monsterinsights Unknown

3.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

AC:H because exploitation requires the non-default condition of GA disconnection; I:L reflects limited config overwrite with no confidentiality or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 15:33 vuln.today

Patch available

Aug 04, 2026 - 07:01 EUVD

CVE Published

Aug 04, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 06:00 cve.org

LOW 3.7

DescriptionCVE.org

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.

AnalysisAI

Signature forgery in the MonsterInsights WordPress plugin before 11.1.0 allows unauthenticated network attackers to overwrite plugin configuration values when the site is not connected to Google Analytics. The root cause is that the HMAC signing key used to authenticate a specific AJAX action defaults to an empty string in that disconnected state, making any forged HMAC trivially valid. The practical impact is limited to disrupting server-side analytics in Manual GA4 mode; no public exploit identified as actively exploited (not in CISA KEV), though a publicly available proof-of-concept exists and the EPSS probability is low at 0.15%.

Technical ContextAI

MonsterInsights exposes unauthenticated AJAX actions that use HMAC signatures to verify the legitimacy of incoming requests. Per CWE-287 (Improper Authentication), the flaw arises because the HMAC signing key is not statically provisioned but instead derived from the Google Analytics connection state. When the plugin has not been configured with a GA connection, the key resolves to an empty string. An HMAC computed with an empty key can be independently replicated by any attacker with knowledge of the action's request format, rendering the authentication check ineffective. The affected CPE is cpe:2.3:a:unknown:monsterinsights:*:*:*:*:*:*:*:* covering all versions prior to 11.1.0. The impact is scoped to overwriting a MonsterInsights configuration value used in Manual GA4 mode, affecting analytics data collection integrity rather than site functionality broadly.

RemediationAI

Update the MonsterInsights WordPress plugin to version 11.1.0 or later, which is the vendor-released patch per the WPScan advisory (https://wpscan.com/vulnerability/283331ca-cc2e-4c2c-9e3b-2e8c6f0c84d2/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-11366). As a compensating control for sites that cannot immediately update, establishing an active Google Analytics connection forces a non-empty HMAC signing key, effectively closing the attack vector - note this requires a valid GA4 property and may change analytics collection behavior. Alternatively, a WAF rule blocking unauthenticated POST requests to the specific AJAX action endpoint can reduce exposure, but this may break legitimate plugin functionality. Disabling the plugin entirely until patching is feasible eliminates risk with no residual analytics impact beyond expected data gaps.