CVE-2026-19224: CWE-94 Improper Control of Generation of Code ('Code Injection') in Hummingbird Performance

The Hummingbird Performance WordPress plugin before version 3.21.2 improperly restricts access to a network-wide setting, enabling an administrator of any single site within a multisite network to execute arbitrary code across the entire network. This is a code injection vulnerability classified as CWE-94. The vulnerability affects version 3.15.0 as explicitly stated. The CVSS 3.1 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

An attacker with administrator privileges on any single site in a multisite WordPress network can execute arbitrary code across the entire network. This can lead to full compromise of all sites in the network, including data theft, site defacement, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description notes that versions before 3.21.2 are affected, implying that upgrading to 3.21.2 or later may resolve the issue. Until an official fix is confirmed, restrict administrator privileges carefully and monitor multisite network configurations.