Vulnerability · Published Aug 6, 2026 · Assigned by WPScan

CVE-2026-11976MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

Critical 10.0

In plain English

A critical-severity security flaw in MonsterInsights Pro from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.5%top 55.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.

Affected products (as reported)

Vendor	Product	Versions
Unknown	MonsterInsights Pro	10.2.0 – before 11.0.0

Weakness: CWE-912 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/d1250410-b919-4a90-8cf2-04031f9e5e2b/ exploit, vdb-entry, technical-description