Was MonsterInsights really hacked?

Yes. The official MonsterInsights.com site was compromised and replaced with a notice confirming the ongoing attack. The company took the site offline while handling the incident.

What does MonsterInsights' CVE-2026-5371 vulnerability do?

The vulnerability (CVSS 7.1 — high severity) affects all versions up to 10.1.2. Due to missing checks on two of the plugin's functions, an attacker could access Google OAuth tokens and Google Ads integration settings.

What should I do if I have MonsterInsights installed?

First, don't download updates from third-party sites — the official site is offline and fake downloads are circulating. Check the official WordPress.org repository for an updated version. Check your Google Analytics account for suspicious access.

Is the plugin safe to use?

Until an official patch is released and the site is restored, it's advisable to temporarily disable the plugin or closely monitor connected Google authentication activity.

MonsterInsights Hacked Phishing 2026

If you have MonsterInsights installed on your WordPress site, read this article before doing anything else.

The plugin — one of the most popular for integrating Google Analytics into WordPress, with over 3 million active installs — is at the center of a serious security incident. The official site has been compromised, phishing campaigns targeting users are underway, and a critical vulnerability in the plugin's code puts Google OAuth tokens at risk.

What's Happening

The official MonsterInsights.com site was attacked and taken offline. In place of the homepage, this notice appears:

"Our site is offline while we handle an attack. Your analytics and tracking are not affected. DO NOT download MonsterInsights from third-party sites: a phishing attempt is underway."

This notice matters for two reasons:

It officially confirms the attack
It explicitly warns about fake downloads — if you're looking for a plugin update on unofficial sites, you're probably downloading malware

The CVE-2026-5371 Vulnerability

Alongside the attack on the site, a vulnerability in the plugin's code was discovered and published: CVE-2026-5371, with a CVSS score of 7.1 out of 10 (high severity).

The problem concerns two functions in the code:

get_ads_access_token()
reset_experience()

Both are missing the necessary authorization checks. In practice, a user with limited access to the site could exploit these functions to access the Google OAuth tokens that connect your site to Google Analytics and Google Ads — and potentially disconnect or manipulate those integrations.

All versions of MonsterInsights up to 10.1.2 are vulnerable.

What to Do Now

If you have MonsterInsights installed, these are the priority actions:

Immediately:

Don't download plugin updates from any site other than WordPress.org
Check whether an update from the official repository is available in your WordPress dashboard
Don't click links in emails that appear to come from MonsterInsights — phishing campaigns are active

Account verification:

Log into Google Analytics and check recent access
In Google Search Console, check for any unauthorized properties added
Revoke MonsterInsights' OAuth tokens if you notice suspicious activity (Google Account → Security → Third-party apps)

Monitoring:

Keep an eye on the official WPScan and WordPress.org sites for patch updates

Why This Story Concerns Anyone Using WordPress

MonsterInsights is installed on 3 million sites. It's not a niche — it's a solid chunk of the WordPress ecosystem. An incident of this scale is a reminder that a site's security doesn't depend only on what you install, but also on the solidity of the infrastructure behind the plugins you use.

A popular, seemingly trustworthy plugin can become an attack vector precisely because it's popular. More installs means a bigger attack surface for anyone looking to exploit a vulnerability.

For real-time updates on the situation, follow WPScan and the official thread on WordPress.org. As soon as a patched version is available, update immediately.