Executive brief
The Really Simple Security WordPress plugin is used to manage security and SSL configurations for WordPress sites. Before version 9.8.0, a subsite administrator in a WordPress multisite network could bypass authorization checks and install malicious plugins to a shared directory, affecting all sites on the network. This requires specific network configuration to enable plugin management for subsites, which is disabled by default.
Technical details
The vulnerability is an authorization bypass (CWE-269) in the rsp_upgrade_install_plugin AJAX action. The plugin fails to verify that the current user has permission to install plugins before downloading and installing a plugin from a user-supplied URL. An authenticated subsite administrator can craft a request with a valid CSRF token from the plugins page and specify an attacker-controlled ZIP file URL. The malicious plugin is then extracted to the network-shared wp-content/plugins directory, making it active across all sites in the network. Exploitation requires: (1) WordPress multisite configuration, (2) the Plugins menu enabled for subsites in network settings (non-default), and (3) the attacker being a subsite administrator. The issue was patched in version 9.8.0.
Affected products
- Really Simple Plugins Really Simple Security before 9.8.0
Timeline
- 2026-08-28: disclosed
- 2026-08-30: patched: Version 9.8.0 fixes the authorization bypass