CVE-2026-11366

The MonsterInsights WordPress plugin, prior to version 11.1.0, contains a flaw that allows attackers without authentication to manipulate its configuration settings through an AJAX action. This is possible because the plugin does not properly verify the authenticity of incoming requests when it's disconnected from Google Analytics, allowing malicious actors to forge valid signatures and alter critical settings. As a result, analytics functionality in Manual GA4 mode may be severely impaired.

Based on public CVE data (MITRE/NVD).