CVE-2026-19224: Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hummingbird Performance WordPress pluginto a version that resolves this vulnerability.Fixed in 3.21.2 - Configuration
Update the plugin so that the affected network-wide setting is restricted to network administrators (not site administrators) on multisite networks.
Hummingbird Performance WordPress plugin (Multisite) network-wide setting restriction to network administrators = restricted to network administrators
Event History
Frequently Asked Questions
Which deployments are exposed to network-wide impact?
WordPress multisite networks using Hummingbird Performance versions earlier than 3.21.2 are exposed. A single-site administrator can affect the entire network rather than only their own site.
What access does an attacker need to exploit this issue?
The attacker needs administrator access on any individual site within the WordPress multisite network. Network administrator access is not required.
How can I determine whether my network is affected?
Check whether WordPress is configured as a multisite network and whether Hummingbird Performance is installed at a version earlier than 3.21.2. Single-site WordPress installations are not described as affected.
What is the available remediation?
Update Hummingbird Performance to version 3.21.2 or later. The issue is caused by allowing individual site administrators to change a network-wide setting, so review and limit administrator accounts across the multisite network until updating is complete.