Really Simple Security CVE-2026-81766

All four conditions must be true simultaneously for exploitation: (1) WordPress must be running in multisite network mode - single-site installations are entirely unaffected; (2) Really Simple Security plugin must be installed and network-activated; (3) the network administrator must have explicitly enabled the Really Simple Security administration menu for subsites, which is NOT the default configuration - this is the single most limiting prerequisite; (4) the attacker must control a subsite administrator account (CVSS PR:H), ruling out unauthenticated or subscriber/editor-level attacks. What limits exploitation beyond these conditions: the attacker cannot be a network-level super administrator (who already has this capability legitimately), so the threat actor is specifically a compromised or malicious subsite admin. Default WordPress multisite deployments with this plugin installed but without the admin-menu-for-subsites setting enabled are not exploitable.

The CVSS 6.6 score (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately captures the tension between severe impact and constrained exploitability: the attacker must already hold subsite administrator credentials and the target network must have the Really Simple Security admin menu enabled for subsites - a non-default configuration that most network administrators will never enable. EPSS at 0.15% (4th percentile) is consistent with these high-bar prerequisites and suggests any exploitation would be opportunistic-targeted rather than mass-automated. The publicly available proof-of-concept from WPScan lowers the skill floor for attackers who do satisfy prerequisites, warranting prompt patching even absent KEV confirmation. The provided S:U (Unchanged scope) rating appears understated given that a subsite admin's actions directly compromise the network-wide plugin directory - defenders should treat the realistic blast radius as network-scoped. No active exploitation is confirmed by CISA KEV, and the low EPSS further supports this assessment. Organizations running WordPress multisite with this plugin should prioritize patching; those without multisite deployments are not affected.

An attacker who has compromised or legitimately holds a subsite administrator account on a WordPress multisite network navigates to the Really Simple Security plugin administration interface - accessible only because the network admin enabled it for subsites - and submits a URL pointing to a malicious plugin ZIP on an attacker-controlled server. The plugin installs the payload into the network-shared plugins directory without enforcing network-admin privilege checks. The malicious plugin is then activated, executing arbitrary PHP code under the web server process with full access to all subsites and the underlying filesystem. A public proof-of-concept published by WPScan documents this exploitation path.