The official MonsterInsights Pro update distribution bucket (monster-insights.s3.amazonaws.com) was compromised, allowing an attacker to insert a malicious file named class-system-check.php into the current release (10.2.2) and the rolled-back version (10.2.0). Three distinct variants of this malicious file were observed on 2026-06-11, all using the same AES-256-GCM key, confirming a single threat actor's involvement. The attacker maintains write access to the S3 bucket and has been actively updating the payload throughout the day. This vulnerability is categorized under CWE-912 (Hidden Functionality), indicating unauthorized hidden code execution within the software update mechanism. The CVSS v3.1 score is 10.0, reflecting critical impact with network attack vector, no privileges required, no user interaction, and complete confidentiality, integrity, and availability compromise. The product is a cloud-hosted service, implying vendor responsibility for patching and mitigation.

An attacker with write access to the official update distribution bucket can insert malicious code into legitimate software updates, leading to full compromise of confidentiality, integrity, and availability of affected systems running MonsterInsights Pro versions 10.2.0 and 10.2.2. This allows remote, unauthenticated attackers to execute hidden malicious functionality without user interaction, posing a critical risk to all users of these versions.

A patch is available for this vulnerability. Since MonsterInsights Pro is a cloud-hosted service with the update distribution bucket compromised, the vendor manages remediation and patch deployment. Users should verify they are running a patched version as per vendor guidance. Patch status is not fully detailed here; check the vendor advisory for current remediation instructions and confirm update integrity before applying.