CVE-2026-81766: Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not the default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Really Simple Security WordPress pluginto a version that resolves this vulnerability.Fixed in 9.8.0 - Configuration
Ensure subsites' administration menus cannot install/upgrade the Really Simple Security WordPress plugin (before 9.8.0) from a user-supplied URL; only allow this capability for the multisite network administrator, not for subsite administrators.
WordPress Multisite (subsite admin) Really Simple Security WordPress plugin installation permission (before 9.8.0 subsite admin menu) = enabled only for network administrators
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An administrator of a subsite in a WordPress multisite network can exploit it. The attacker must be able to use the affected plugin's administration functionality from that subsite.
Are default multisite installations affected?
Not by default. Exploitation requires the network administrator to have enabled the Really Simple Security administration menu for subsites, and this setting is not enabled by default.
What access does exploitation provide?
A subsite administrator can install code from a user-supplied URL into the network-shared plugin directory and execute arbitrary code. This bypasses WordPress's normal restriction that reserves that directory for the network administrator.
What should be checked during triage?
Verify whether the site is a WordPress multisite network, uses a version of the plugin before 9.8.0, and has enabled the plugin's administration menu for subsites. Subsite administrator accounts are the relevant threat boundary.