CVE-2026-96896: Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request
The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcure Malware Shield — Removal, Repair, Monitor WordPress pluginto a version that resolves this vulnerability.Fixed in 19.9.7
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue affects WordPress multisite networks using Malcure Malware Shield versions before 19.9.7. It specifically requires a user with a subsite administrator role; the shared network filesystem is the affected resource.
What access does an attacker need to exploit this?
An attacker must be able to act as a subsite administrator in the WordPress multisite network. The vulnerable AJAX action lacks an authorization check, allowing that role to write or delete arbitrary files in the shared filesystem.
What is the likely impact if exploitation succeeds?
An attacker can write and delete arbitrary files in the network's shared filesystem. Arbitrary file writing can lead to remote code execution.
How can I determine whether my site is affected?
Check whether the site is a WordPress multisite network and whether Malcure Malware Shield is installed at a version earlier than 19.9.7. Also review whether untrusted or unnecessary accounts hold subsite administrator privileges.