EUVD-2026-68160
GHSA-c5mg-rwrq-r34j
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Scope changed to C because the subsite admin's action directly writes into the network-shared plugin directory, crossing the multisite privilege boundary beyond the vulnerable component's authorization scope.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not the default.
AnalysisAI
Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrator on a WordPress multisite network to install an arbitrary plugin from a user-supplied URL, placing attacker-controlled PHP code into the network-shared plugin directory normally reserved for network (super) administrators. Successful exploitation achieves remote code execution with full confidentiality, integrity, and availability impact across the entire multisite network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All four conditions must be true simultaneously for exploitation: (1) WordPress must be running in multisite network mode - single-site installations are entirely unaffected; (2) Really Simple Security plugin must be installed and network-activated; (3) the network administrator must have explicitly enabled the Really Simple Security administration menu for subsites, which is NOT the default configuration - this is the single most limiting prerequisite; (4) the attacker must control a subsite administrator account (CVSS PR:H), ruling out unauthenticated or subscriber/editor-level attacks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.6 score (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately captures the tension between severe impact and constrained exploitability: the attacker must already hold subsite administrator credentials and the target network must have the Really Simple Security admin menu enabled for subsites - a non-default configuration that most network administrators will never enable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Really Simple Security WordPress plugin to version 9.8.0 or later, which introduces proper network-administrator privilege verification before plugin installation from user-supplied URLs; this is the primary fix confirmed available from the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Really Simple Security
View allThe Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass
Two-factor authentication bypass in the Really Simple Security WordPress plugin before 9.5.10.1 allows attackers who alr
Same weakness CWE-269 – Improper Privilege Management
View allShare
External POC / Exploit Code
Leaving vuln.today