Read the docs
TI-2026-56402 Aliases CVE-2026-81766GHSA-c5mg-rwrq-r34j

Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

Priority LOW 32CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-269.

Summary

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not the default.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00435 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Really Simple Security (Unknown): 9.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownReally Simple Securitybefore 9.8.09.8.0Patch availableCNA
  • Really Simple Security VendorUnknown Affected before 9.8.0 Fixed in 9.8.0 Patch available CNA

Remediation

  • Fix · CNA Really Simple Security (Unknown) Fixed in 9.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81766
  2. 2026-10-03 Alias added: GHSA-c5mg-rwrq-r34j

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences