CVE-2026-11366

The MonsterInsights WordPress plugin before 11.1.0 is affected by an unauthenticated signature validation flaw in one AJAX action: when not connected to Google Analytics, the HMAC signing key is empty, enabling attackers to forge a valid signature and overwrite a configuration value, disrupting s...