Threats tagged 'ghsa-w2mq-7hp5-vcv5'

The MonsterInsights Pro update distribution S3 bucket was compromised, allowing an attacker to insert a malicious file into versions 10.2.0 and 10.2.2 of the software. The malicious file, class-system-check.php, was found in three variants sharing the same encryption key, indicating a single threat actor with ongoing access. This vulnerability is classified as CWE-912 (Hidden Functionality) and has a critical CVSS score of 10. The attacker retains write access to the update distribution bucket, posing a severe risk of supply chain compromise. The product is a cloud service, and a patch is available.