CVE-2026-81766: CWE-269 Improper Privilege Management in Really Simple Security

The Really Simple Security WordPress plugin versions prior to 9.8.0 do not properly verify whether a user has permission to install the plugin from a user-supplied URL. This improper privilege management (CWE-269) enables a subsite administrator within a multisite WordPress network to install and execute arbitrary code in the network-shared plugin directory. This directory is typically reserved for the network administrator. Successful exploitation depends on the network administrator enabling the plugin's administration menu for subsites, which is not the default configuration.

An attacker with subsite administrator privileges on a multisite WordPress network can execute arbitrary code with the privileges of the network-shared Really Simple Security plugin directory. This can lead to full compromise of the multisite network environment. The vulnerability has a CVSS score of 6.6 (medium severity), reflecting high impact on confidentiality, integrity, and availability, but requiring high privileges and user interaction is not required.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, network administrators should avoid enabling the Really Simple Security plugin administration menu for subsites, as this setting is required for exploitation. Monitoring and restricting subsite administrator privileges may also reduce risk.