CVE-2026-11976: MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise
Vulnerability summary
CVE-2026-11976 is a critical (CVSS 10.0) Hidden Functionality vulnerability in unknown monsterinsights pro. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 06-08-2026PublishedVulnerability first disclosed.
- 07-08-2026Last modifiedVulnerability information updated.
Description
The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
Increase +0.04 pp
From 0.49% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-912Hidden FunctionalityThe product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
- CWE-506Embedded Malicious CodeThe product contains code that appears to be malicious in nature.
Affected systems
Unknown1 product
- monsterinsights pro≥ 10.2.0, < 11.0.0
Wordpress1 product
- google-analytics-premium≥ 10.2.0, < 11.0.0
2 vendors · 2 products