HT Easy GA4 ( Google Analytics 4 ) <= 1.9.4 - Missing Authorization to Unauthenticated Secret Key Update and Cache Deletion
- ID
- WPSEC-2026-0130
- Plugin
- HT Easy GA4 – Google Analytics WordPress Plugin (ht-easy-google-analytics)
- Affected
- from 1.7.0 before 1.9.5
- Remediation
- Update to 1.9.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- HT Easy GA4 ( Google Analytics 4 ) on WPSec AttackSurface
- Fix released
- Published
Description
The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data in versions 1.7.0 up to, and including, 1.9.4. The Admin class constructor, which runs on every request including front-end ones, lacks a capability check and nonce verification. It writes the 'secret_key' GET parameter into the htga4_secret_key option and clears the cached access token and account transients whenever an 'email' parameter is present. This makes it possible for unauthenticated attackers to overwrite the secret key that signs token-refresh and logout requests to the authentication server, breaking the site's Google Analytics reporting integration.
References
- https://wpsec.com/vuln/WPSEC-2026-0130/
- https://plugins.svn.wordpress.org/ht-easy-google-analytics/tags/1.9.5/
- https://wordpress.org/plugins/ht-easy-google-analytics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS