# CVE-2026-81766: Really Simple Security WordPress plugin arbitrary plugin installation in multisite

Source: https://junglewise.ai/threats/cve-2026-81766-really-simple-security-wordpress-plugin-arbitrary-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81766 · Severity: medium · CVSS 6.6 · Published 2026-08-30

The Really Simple Security WordPress plugin is used to manage security and SSL configurations for WordPress sites. Before version 9.8.0, a subsite administrator in a WordPress multisite network could bypass authorization checks and install malicious plugins to a shared directory, affecting all sites on the network. This requires specific network configuration to enable plugin management for subsites, which is disabled by default.

Technologies: [Really Simple Plugins Really Simple Security](https://junglewise.ai/threats/technologies/really-simple-security). Vendors: [Really Simple Plugins](https://junglewise.ai/threats/vendors/really-simple-plugins).

## Quick answers

**Is CVE-2026-81766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81766 being exploited in the wild.

**How severe is CVE-2026-81766?** Medium severity, with a CVSS score of 6.6, published 30 August 2026.

**Which products and versions are affected?** Really Simple Plugins Really Simple Security before 9.8.0.

**Is there a fix for CVE-2026-81766?** A patch was published on 2026-08-30: Version 9.8.0 fixes the authorization bypass Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81766 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81766?** Check whether you run Really Simple Plugins Really Simple Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-269) in the rsp_upgrade_install_plugin AJAX action. The plugin fails to verify that the current user has permission to install plugins before downloading and installing a plugin from a user-supplied URL. An authenticated subsite administrator can craft a request with a valid CSRF token from the plugins page and specify an attacker-controlled ZIP file URL. The malicious plugin is then extracted to the network-shared wp-content/plugins directory, making it active across all sites in the network. Exploitation requires: (1) WordPress multisite configuration, (2) the Plugins menu enabled for subsites in network settings (non-default), and (3) the attacker being a subsite administrator. The issue was patched in version 9.8.0.

## Affected products

- Really Simple Plugins Really Simple Security before 9.8.0

## Timeline

- 2026-08-28: disclosed
- 2026-08-30: patched: Version 9.8.0 fixes the authorization bypass

## References

- [https://wpscan.com/vulnerability/948d70a2-605e-4a83-8feb-eca4dbb5f948/](https://wpscan.com/vulnerability/948d70a2-605e-4a83-8feb-eca4dbb5f948/)

## Related threats

- [Really Simple Security authorization bypass in two-factor authentication](https://junglewise.ai/threats/cve-2026-82519-really-simple-security-authorization-bypass-in-two-factor)
- [Really Simple Security 2FA bypass in REST API endpoints](https://junglewise.ai/threats/cve-2026-8293-really-simple-security-2fa-bypass-in-rest-api-endpoints)