CVE-2026-19224
Received Received - Intake

Arbitrary Code Execution in Hummingbird Performance WordPress Plugin

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: WPScan

Description
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-19224
EUVD
EUVD-2026-70902

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hummingbird_performance hummingbird_performance to 3.21.2 (exc)
wpbeaverbuilder hummingbird to 3.21.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Hummingbird Performance WordPress plugin before version 3.21.2 allows administrators of any single site in a multisite network to execute arbitrary code across the entire network due to insufficient restrictions on network-wide settings.

Detection Guidance

Check the installed version of the Hummingbird Performance plugin. If it is below 3.21.2, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

An attacker with admin access to any site in a multisite network could exploit this to run malicious code across all sites, potentially leading to data breaches, site defacement, or further compromise of the entire network.

Compliance Impact

This vulnerability could lead to unauthorized access and data exposure, violating compliance requirements for GDPR (data protection) and HIPAA (health data security), potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Update the Hummingbird Performance plugin to version 3.21.2 or later immediately. Restrict network administrator privileges to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19224. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart