CVE-2026-81766 Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin
Subsite administrators can install arbitrary plugins in the network directory, enabling code execution and privilege escalation if the subsite admin menu is enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81766?
CVE-2026-81766 is a medium-severity vulnerability in Unknown Really Simple Security, published on 30 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not the default.
Weakness: CWE-269
Which versions are affected by CVE-2026-81766?
How do I fix CVE-2026-81766?
No fix has been published for CVE-2026-81766 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81766 being exploited?
There is no known exploitation of CVE-2026-81766 in the wild and no public exploit code.
Sources
Also known as GHSA-c5mg-rwrq-r34j.