If you have MonsterInsights installed on your WordPress site, read this article before doing anything else.
The plugin — one of the most popular for integrating Google Analytics into WordPress, with over 3 million active installs — is at the center of a serious security incident. The official site has been compromised, phishing campaigns targeting users are underway, and a critical vulnerability in the plugin's code puts Google OAuth tokens at risk.
What's Happening
The official MonsterInsights.com site was attacked and taken offline. In place of the homepage a notice appears: the site is offline because of an attack, analytics and tracking are not affected, and MonsterInsights must not be downloaded from third-party sites, because a phishing attempt is underway.
This notice matters for two reasons:
- It officially confirms the attack
- It explicitly warns about fake downloads — if you're looking for a plugin update on unofficial sites, you're probably downloading malware
The CVE-2026-5371 Vulnerability
Alongside the attack on the site, a vulnerability in the plugin's code was discovered and published: CVE-2026-5371, with a CVSS score of 7.1 out of 10 (high severity).
The problem concerns two functions in the code:
get_ads_access_token()reset_experience()
Both are missing the necessary authorization checks. In practice, a user with limited access to the site could exploit these functions to access the Google OAuth tokens that connect your site to Google Analytics and Google Ads — and potentially disconnect or manipulate those integrations.
All versions of MonsterInsights up to 10.1.2 are vulnerable.
What to Do Now
If you have MonsterInsights installed, these are the priority actions:
Immediately:
- Don't download plugin updates from any site other than WordPress.org
- Check whether an update from the official repository is available in your WordPress dashboard
- Don't click links in emails that appear to come from MonsterInsights — phishing campaigns are active
Account verification:
- Log into Google Analytics and check recent access
- In Google Search Console, check for any unauthorized properties added
- Revoke MonsterInsights' OAuth tokens if you notice suspicious activity (Google Account → Security → Third-party apps)
Monitoring:
- Keep an eye on the official WPScan and WordPress.org sites for patch updates
Why This Story Concerns Anyone Using WordPress
MonsterInsights is installed on 3 million sites. It's not a niche — it's a solid chunk of the WordPress ecosystem. An incident of this scale is a reminder that a site's security doesn't depend only on what you install, but also on the solidity of the infrastructure behind the plugins you use.
A popular, seemingly trustworthy plugin can become an attack vector precisely because it's popular. More installs means a bigger attack surface for anyone looking to exploit a vulnerability.
For real-time updates on the situation, follow WPScan and the official thread on WordPress.org. As soon as a patched version is available, update immediately.