CVE-2026-81766
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Really Simple Security WordPress plugin before 9.8.0 does not check if the user is allowed to install plugins, allowing a subsite administrator on a multisite network to install and execute arbitrary code in the network-shared plugin directory. Exploitation requires the network administrator to have enabled the plugin's administration menu for subsites, which is not the default.
Risk Assessment
Risk of full compromise of the WordPress multisite environment by a subsite administrator, potentially leading to arbitrary code execution in the network context.
Recommendation
Update the Really Simple Security plugin to version 9.8.0 or later. Additionally, if not necessary, disable the plugin's administration menu for subsites.
Other vulnerabilities in Really Simple Security
See all- CVE-2026-88798Medium
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
- CVE-2026-82519Medium
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler.
Original NVD description (English source)
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not the default.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS