CVE-2026-11976

MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.

We have discovered 261,434 live websites that are affected by CVE-2026-11976.

Run a Free Instant Scan



Affected Software

Product  MonsterInsights
Category Analytics
Vulnerable Domains261,434 live websites (41% of MonsterInsights install base)
Vulnerable Versions
  • from 10.2 through 11
Vulnerable Versions Count3 versions ( 1.57% of all versions)


Common Weakness Enumeration

CWE-912 Hidden Functionality



Details

  • Published - Aug 6, 2026
  • Updated - Aug 7, 2026

Credits

  • Mike Gozdiskowski (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-11976
United States108,165 websites


Japan17,126 websites
GB14,845 websites
Germany14,158 websites
France12,448 websites
Netherlands9,818 websites
Italy7,371 websites
Canada6,990 websites
Spain5,236 websites
Australia5,184 websites

Website Distribution by TLD

Number of websites using CVE-2026-11976
.com130,449 websites
.org16,804 websites
.co.uk9,411 websites
.nl8,885 websites
.net7,223 websites
.de6,140 websites
.fr5,613 websites
.it5,235 websites
.com.au4,610 websites
.ca4,187 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-11976

Top websites that are affected by CVE-2026-11976. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com United States*,***
*****************.com United States*,***
************.com United States**,***
****.ca Canada**,***
*********************.fr France**,***
***********.eu Hungary**,***
********.com United States**,***
*************.com United States**,***
*******.com United States**,***
************.com United States**,***
See full domain list

FAQ

CVE-2026-11976 is Hidden Functionality in MonsterInsights
A total of 261,434 websites have been identified as vulnerable to CVE-2026-11976, based on global website indexing conducted by WebTechSurvey.
The MonsterInsights is affected by the CVE-2026-11976 vulnerability.
MonsterInsights versions up to 11 are vulnerable to CVE-2026-11976.
CVE-2026-11976 is resolved in version 11 of MonsterInsights.