CVE-2026-81766: 
WordPress vulnerability analysis and mitigation

CVE-2026-81766 is a privilege escalation vulnerability in the Really Simple Security WordPress plugin (also known as really-simple-ssl) affecting all versions before 9.8.0. The flaw allows a subsite administrator on a WordPress multisite network to install arbitrary plugins from attacker-controlled URLs and execute arbitrary code in the network-shared plugin directory — a capability normally restricted to network administrators. It was publicly disclosed on August 28, 2026, with a patch released in version 9.8.0. The vulnerability carries a CVSS score of 6.6 (Medium) per WPScan, though Feedly estimates it as HIGH severity (WPScan, GitHub Advisory).

The root cause is an improper privilege management flaw (CWE-269) in the plugin's rsp_upgrade_install_plugin function, which fails to verify that the requesting user has sufficient permissions to install plugins before processing a user-supplied URL. On WordPress multisite installations, plugin management in the network-shared directory is reserved for network administrators; however, this missing authorization check allows a subsite administrator to bypass that restriction. Exploitation requires a non-default configuration: the network administrator must have explicitly enabled the Really Simple Security administration menu for subsites. The vulnerability is classified under OWASP Top 10 A2 (Broken Authentication and Session Management) (WPScan, GitHub Advisory).

Successful exploitation allows a subsite administrator to install a malicious plugin from an attacker-controlled URL into the network-shared plugin directory, resulting in arbitrary code execution with the privileges of the web server process. Because the compromised plugin directory is shared across the entire multisite network, the impact extends beyond the individual subsite — potentially affecting all sites within the network. This could lead to full network compromise, data exfiltration, backdoor installation, or further lateral movement within the hosting environment (WPScan, GitHub Advisory).

There is no public proof-of-concept exploit available at the time of disclosure; WPScan has indicated a PoC will be published on September 11, 2026, to allow time for users to update. No in-the-wild exploitation has been observed. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is constrained by the requirement that the network administrator must have enabled the Really Simple Security administration menu for subsites, which is a non-default configuration (WPScan, GitHub Advisory).

1. Identify target: Locate a WordPress multisite installation running Really Simple Security plugin version below 9.8.0 where the network administrator has enabled the Really Simple Security administration menu for subsites.
2. Obtain subsite admin access: Authenticate as an administrator of any subsite within the multisite network (this could be via legitimate credentials, phishing, or credential stuffing).
3. Prepare malicious plugin: Create or obtain a malicious WordPress plugin package hosted at an attacker-controlled URL. The plugin should contain a web shell or reverse shell payload.
4. Trigger vulnerable function: Send a crafted request to the rsp_upgrade_install_plugin endpoint, supplying the attacker-controlled URL as the plugin source. The function does not validate the caller's permission to install network-wide plugins.
5. Achieve code execution: The malicious plugin is installed into the network-shared plugin directory and can be activated, resulting in arbitrary code execution with web server process privileges across the entire multisite network (WPScan).

• Logs: WordPress debug or access logs showing unexpected POST requests to the rsp_upgrade_install_plugin endpoint from a subsite administrator account; plugin installation events in the WordPress admin log attributed to a subsite (non-network) administrator.
• File System: Unexpected or newly created plugin directories under wp-content/plugins/ containing unfamiliar PHP files, web shells, or files with obfuscated code; file timestamps inconsistent with legitimate plugin updates.
• Network: Outbound HTTP/HTTPS requests from the web server to unknown external URLs during plugin installation; outbound connections to attacker-controlled infrastructure from the web server process after plugin activation.
• Process: Unusual child processes spawned by the web server (e.g., php, bash, curl, wget) executing commands not consistent with normal WordPress operation.

Update the Really Simple Security WordPress plugin to version 9.8.0 or later, which contains the fix for this vulnerability. As an interim workaround, network administrators should disable the Really Simple Security administration menu for subsites if it has been enabled, reverting to the secure default configuration. Additionally, restrict subsite administrator accounts to trusted users only, and implement network-level controls to prevent unauthorized outbound connections from the web server. Regularly audit installed plugins across the multisite network for unexpected additions (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by security researcher Charles Vosburgh, who submitted it through WPScan. WPScan has applied a responsible disclosure timeline, withholding the proof-of-concept until September 11, 2026, to allow users adequate time to patch. No significant broader media coverage or notable social media commentary has been identified at this time (WPScan).