CVE-2026-11976
Critical
Description
The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.
SeverityCritical
CVSS10.0
Exploit probability—
ProductMonsterInsights Pro
PublishedAug 6, 2026
First seenAug 6, 2026
Weakness typeCWE-912CWE-912
How to fix
Update
- MonsterInsights Pro11.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| MonsterInsights Pro | 10.2.0 ≤ v < 11.0.0 | 11.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.