MonsterInsights CVE-2026-11366

Exploitation requires the target WordPress site to have the MonsterInsights plugin installed in version below 11.1.0 AND the plugin must not be actively connected to a Google Analytics account - this disconnected state is what causes the HMAC signing key to be empty. Sites running MonsterInsights with a valid GA4 connection are NOT vulnerable because a non-empty key is derived from that connection, making HMAC forgery computationally infeasible. The attack is further limited to overwriting a single configuration value relevant to Manual GA4 mode analytics; it does not grant code execution, database access, or WordPress administrative privileges. Exploitation is bounded by the CVSS AC:H rating, reflecting this mandatory non-default or transitional configuration state.

The NVD CVSS 3.1 score of 3.7 (Low) accurately reflects the constrained real-world risk. AV:N/PR:N confirms the endpoint is remotely accessible without authentication, but AC:H captures the critical prerequisite: the attack only succeeds when the plugin is not connected to Google Analytics, a non-default or transitional deployment state. The integrity impact is limited (I:L) to a single configuration value affecting analytics, with no confidentiality or availability loss. The EPSS score of 0.15% (4th percentile) aligns with this assessment - despite a public PoC, automated or broad exploitation is unlikely given the narrow precondition. There is no CISA KEV listing. The public PoC (WPScan) elevates script-kiddie risk slightly for sites in the vulnerable configuration, but the limited blast radius (analytics disruption, not account takeover or RCE) keeps this firmly a low-priority item for most organizations. No conflicting signals between data sources were identified.

An attacker discovers a WordPress site running MonsterInsights in Manual GA4 mode without an active Google Analytics connection - identifiable via plugin metadata in page source or WPScan enumeration. The attacker crafts a POST request to the plugin's AJAX endpoint, computing a trivially valid HMAC using an empty key, and submits a payload that overwrites a MonsterInsights configuration value. The result is corrupted or disabled analytics data collection, which could mask legitimate traffic from administrators or serve as a precursor to further reconnaissance. A publicly available PoC from WPScan documents the exact request format.