CVE-2026-8944

MEDIUM

Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-8944. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-8944, a Cross-Site Request Forgery (CSRF) vulnerability in the 'Plugin for Google Analytics by IO technologies' WordPress plugin (versions ≤1.1). The code includes metadata and a placeholder `run()` method but lacks actual exploit implementation.

Description

The Plugin for Google Analytics by IO technologies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the Google Analytics settings page (ga.php). This makes it possible for unauthenticated attackers to update the plugin's stored Google Analytics tracking ID option (io-ga-id) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-8944_the_plugin_for.py

This repository contains an auto-generated stub module for CVE-2026-8944, a Cross-Site Request Forgery (CSRF) vulnerability in the 'Plugin for Google Analytics by IO technologies' WordPress plugin (versions ≤1.1). The code includes metadata and a placeholder `run()` method but lacks actual exploit implementation.

Classification
Stub 99%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Plugin for Google Analytics by IO technologies (WordPress plugin) versions up to and including 1.1
No auth needed
Prerequisites: Target must have the vulnerable WordPress plugin installed · Attacker must trick a logged-in admin/user into visiting a malicious link
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 4.3
EPSS 0.0010
EPSS Percentile 1.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (1)
engagementanalytics/Plugin for Google Analytics by IO technologies < 1.1
Published Jun 30, 2026
Tracked Since Jun 30, 2026