CVE-2026-81766
Received Received - Intake

Privilege Escalation in Really Simple Security WordPress Plugin

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: WPScan

Description
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not the default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-81766
EUVD
EUVD-2026-68160

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
really_simple_security really_simple_security to 9.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Really Simple Security WordPress plugin versions before 9.8.0. It allows a subsite administrator in a WordPress multisite network to install arbitrary plugins via a specific function, even though WordPress typically restricts plugin installation to network administrators. The plugin fails to verify user permissions before installing a plugin from a user-supplied URL.

Detection Guidance

Check if the Really Simple Security plugin version is below 9.8.0 by inspecting the plugin directory or WordPress admin panel. Look for unauthorized plugin installations in the network-shared directory.

Impact Analysis

An attacker with subsite administrator access could exploit this to install malicious plugins across the entire WordPress multisite network. This could lead to unauthorized code execution, data breaches, or complete control over the network if the installed plugins contain malware or backdoors.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage due to exposed sensitive data.

Mitigation Strategies

Update the Really Simple Security plugin to version 9.8.0 or later immediately. Disable the Plugins administration menu for subsites if enabled by the network administrator.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart