EUVD-2026-70902
GHSA-v4wx-7r7q-x8q9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
S:C applied because the site-admin action crosses the multisite security boundary, impacting all network sites beyond the attacker's own.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
AnalysisAI
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target WordPress installation must be configured as a multisite network (not a standard single-site install); (2) the Hummingbird Performance plugin must be installed and activated network-wide in a version between 3.15.0 and 3.21.1; and (3) the attacker must hold an administrator role on at least one site within that multisite network (PR:H per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) captures the network accessibility and full CIA triad impact but arguably under-represents the scope, since a site-admin action cascades to the entire multisite network - an argument for S:C rather than S:U. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Hummingbird Performance to version 3.21.2 or later, which is the vendor-confirmed patched release adding the appropriate network-administrator capability check to the affected setting. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Given that publicly available exploit code exists, treat this as urgent. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today