MonsterInsights Pro distributed itself from an official AWS S3 bucket that was compromised, allowing an attacker to insert a malicious PHP file named class‑system‑check.php into the plugin package. When a WordPress site downloads or updates the plugin from that bucket, the plugin contains the injected file. The file is executed within the plugin's context, giving the attacker the potential to run arbitrary PHP code, read and modify site data, and fully control the WordPress installation. The exact capabilities of the file are not disclosed, but its presence in the update package subjects any site that installed or updated the affected releases to the same risk.

WordPress installations that use MonsterInsights Pro version 10.2.0 or 10.2.2, or that have installed a plugin update from the compromised product distribution bucket, are affected. Any user who has installed or updated the plugin between its 10.2.0, 10.2.2 releases during the attack window should verify that the plugin files are clean.

This vulnerability carries a CVSS score of 10, indicating critical impact. Its EPSS score of less than 1% suggests that the likelihood of exploitation by the broader community is currently very low, and it is not listed in the CISA KEV catalog. However, an active threat actor has repeatedly iterated on the payload, and the known supply‑chain compromise provides a very direct attack path: automatic or manual download of the plugin package from the infiltrated bucket delivers the malicious file to the site. The CWE-912 weakness indicates that improper validation during the application or component loading process enables this type of code injection.