MonsterInsights Pro CVE-2026-11976

Exploitation requires that the site run MonsterInsights Pro and obtain the plugin artifact from the compromised official channel (monster-insights.s3.amazonaws.com) at or after the 2026-06-11 compromise - specifically versions 10.2.2 or 10.2.0. The triggering action is installing, updating, or rolling back to those builds; sites that pinned an earlier clean version and did not pull from the bucket during the compromise window are not affected. There is no authentication barrier for the attacker because delivery rides the vendor's trusted distribution, but the limiting factor is deployment scope: only environments that actually fetched and installed a trojaned build are compromised, and only the MonsterInsights Pro (paid) product line served from that bucket is implicated. Removal/execution of the malicious code occurs with normal PHP privileges once installed.

This is a genuine top-priority incident rather than an inflated high-CVSS score. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) reflects full host compromise via a network-delivered trojan with no attacker-side authentication, and the qualitative signals reinforce it: a compromised official distribution channel, an attacker retaining write access, and active same-day payload iteration mean the malicious code reaches victims through their normal, trusted update process. No EPSS score, no CISA KEV entry, and no standalone POC are present in the input, and SSVC fields were not supplied - but those absences understate risk here because exploitation does not require a separate exploit: installing or updating the plugin IS the compromise. One caveat to verify: CVSS models an attacker acting against a victim, whereas this is a supply-chain trojan pulled by the victim, so UI:N is arguable (auto-update vs. manual update) - the operational conclusion is unchanged. Treat any site running 10.2.0 or 10.2.2 as potentially compromised.

A WordPress administrator running MonsterInsights Pro applies what appears to be a routine update (10.2.2), or downgrades to 10.2.0 on advice to 'roll back', and in doing so installs the attacker's class-system-check.php. The file executes within WordPress on the next request, decrypting its AES-256-GCM payload to run arbitrary PHP as the web user - enabling data theft, credential harvesting, or a persistent web shell. No separate exploit tool is needed; the vendor's trusted update channel is the delivery mechanism.