The IO Technologies’ Plugin for Google Analytics for WordPress allows an attacker to submit a forged request that bypasses nonce validation on the settings page. By instructing a logged‑in site administrator to visit a crafted link, the attacker can change the stored tracking ID used by the site without authentication. This flaw enables attackers to alter site configuration and potentially track or influence visitor data silently.

WordPress sites running IO Technologies’ Plugin for Google Analytics up to and including version 1.1 are vulnerable. Administrators using any deployment of this plugin before the patch cannot rely on the plugin’s nonce checks to protect the ga.php settings page.

The CVSS score of 4.3 indicates a moderate impact. There is no EPSS data currently available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires social engineering to get a site administrator to click a malicious link; no remote code execution or privilege escalation is possible, but the compromise can silently alter analytics data. Given the moderate score and lack of widespread exploitation evidence, the risk is present but limited to configuration manipulation scenarios.