CVE-2026-11976
CriticalCVSS 10.0Summary
The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.
Risk Assessment
Organizations using MonsterInsights Pro may have malicious software installed that can steal data, intercept traffic, or provide remote access. Since the attacker still has bucket access, future updates may also be compromised.
Recommendation
Immediately verify the integrity of MonsterInsights plugin files, especially class-system-check.php. If malicious, remove it and restore a clean version. Monitor network traffic and consider rotating all passwords and API keys.
Original NVD description (English source)
The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.