CVE-2026-11976: MonsterInsights Pro Official S3 Bucket Compromised With WebShell Backdoor, CVSS 10.0

WPScan disclosed CVE-2026-11976 on 6 August against the MonsterInsights Pro official update bucket, CVSS 10.0. Attackers planted class-system-check.php in 10.2.0/10.2.2, hijacked the update channel, and created a persistent admin account that cannot be cleared by deleting the plugin.

WPScan published the CVE-2026-11976 supply-chain incident on 6 August 2026, CVSS v3.1 10.0, affecting MonsterInsights Pro 10.2.0 and 10.2.2. Attackers compromised the official update hosting bucket monster-insights.s3.amazonaws.com and injected an encrypted WebShell into the plugin distribution package. Any site that installed or updated was immediately under remote control. Together with concurrently disclosed Supsystic (CVE-2026-17032) and Premium SEO (CVE-2026-14812), this formed an August 2026 cluster of supply-chain attacks against official WordPress premium-plugin distribution channels.

Incident overview

The planted file is class-system-check.php. Researchers observed three variants on 11 June sharing the same AES-256-GCM key, indicating a single threat actor iterating the payload. The most severe variant hijacks MonsterInsights and ExactMetrics own update-check mechanism, redirects subsequent update requests to attacker infrastructure, and creates a persistent WordPress administrator account with a GET-parameter auth bypass. Deleting MonsterInsights from the plugin directory does not remove the backdoor; it retains an independent write path.

Technical details

• Entry: write access to the official update distribution bucket monster-insights.s3.amazonaws.com was obtained by the attacker.
• Injection point: class-system-check.php was injected into both 10.2.2 (current version) and 10.2.0 (official rollback version) packages.
• Payload encryption: three variants share the same AES-256-GCM key and decode/execute via openssl_decrypt.
• Persistence: registers independent cron and custom admin ajax endpoints; hijacks plugins_api() and pre_set_site_transient_update_plugins hooks; writes a new administrator user.
• Auth bypass: HMAC-checks request parameters with a hardcoded shared secret, then returns a forged login cookie.
• Scope: tainted packages exist only in paid MonsterInsights Pro; the free edition is unaffected. Historically, multiple plugins from the same developer shared S3 credentials and the release pipeline.

Impact

• CVSS 3.1: 10.0 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
• Exploit complexity: extremely low. Official update alone triggers it.
• Actual harm: ① full WordPress admin control; ② subsequent arbitrary code via hijacked update channel; ③ long-term stealthy persistence.
• Blast radius: all sites running MonsterInsights Pro 10.2.0 / 10.2.2 that performed an update; WordPress, WooCommerce, and numerous commercial sites affected.

Remediation

• Immediate upgrade: upgrade to MonsterInsights Pro 11.0.0 or later, the currently confirmed clean release line.
• Do not only delete the plugin: deletion does not clear the persistent backdoor. Additionally audit admin accounts, cron, hidden plugins, and outbound update request targets.
• Full hunt: wp user list --role=administrator to list suspicious accounts; wp option get siteurl to check the update channel; grep -r class-system-check wp-content to inspect the plugin directory.
• Credential rotation: rotate all admin passwords, Application Passwords, and object-storage (AWS/S3) credentials. If the site was compromised, rebuild from a clean image.
• Detection: alert in WAF on suspicious PHP files under /wp-content/plugins/google-analytics-for-wordpress/; use wp plugin verify-checksums to verify free-plugin integrity (paid edition has no public manifest and cannot be checksummed).

Sources

• NVD CVE-2026-11976
• WPScan Advisory
• IONIX Threat Center technical analysis
• kkm-mako August WordPress supply-chain incident notes