CVE-2026-81766— Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin
Quick assessment
Affected
Unknown Really Simple Security
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 “Really Simple Security” 在 9.8.0 版本之前未校验用户是否有权安装该插件（原文中存在重复文本，实际意为：在从用户提供的 URL 安装插件前，未检查该用户是否具备安装权限）。这一缺陷允许多站点网络中的子站点管理员在由网络共享的 “Really Simple Security” 插件目录中安装并执行任意代码，而该目录本应由网络管理员独占管理。 要利用此漏洞，需要网络管理员已为子站点启用 “Really Simple Security” 的管理菜单（该设置并非默认开
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81766
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin
Source: CVE Program / CVE List V5
Vulnerability Description
The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not the default.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Really Simple Security | 0 ~ 9.8.0 | - |
|
II. Public POCs for CVE-2026-81766
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81766
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-81766 (1)
Same Patch Batch · Unknown · 2026-08-30 · 7 CVEs total
| CVE-2026-81660 | Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field | |
| CVE-2026-78364 | MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List | |
| CVE-2026-19722 | WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup | |
| CVE-2026-76585 | Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Para | |
| CVE-2026-14835 | SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Pos | |
| CVE-2026-14307 | Geotargeting WP < 3.5.6.2 - Reflected XSS |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-81660
Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web For -
CVE-2026-78364
MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data Lis -
CVE-2026-19722
WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File -
CVE-2026-76585
Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated -
CVE-2026-14835
SOGO Add Script to Individual Pages Header Footer <= 3.9 - C
V. Comments for CVE-2026-81766
No comments yet