Executive brief
MonsterInsights is a popular WordPress plugin used to integrate Google Analytics tracking on websites. When the plugin is configured in Manual GA4 mode without an active Google Analytics connection, an attacker can forge valid requests to overwrite the plugin's Measurement Protocol secret, causing the site to send analytics data to an attacker-controlled endpoint instead of Google Analytics, disrupting analytics accuracy and potentially exposing visitor behavior data.
Technical details
The plugin implements HMAC-MD5 signature validation on unauthenticated AJAX actions but fails to handle the case where the signing key is empty. When MonsterInsights operates in Manual GA4 mode without an OAuth connection, the HMAC key is initialized as an empty string. An unauthenticated attacker can exploit this by computing a valid HMAC-MD5 signature over an empty key and send a crafted POST request to the monsterinsights_push_mp_token AJAX action to overwrite the measurement_protocol_secret configuration value stored in the WordPress options table. The attack requires the plugin to be in Manual GA4 mode with a Measurement ID configured but no active Google Analytics connection. The fix was implemented in version 11.1.0.
Affected products
- MonsterInsights MonsterInsights before 11.1.0
Timeline
- 2026-07-27: disclosed
- 2026-11-01: patched: Fixed in version 11.1.0
- 2026-08-04: advisory