Prior to version 3.21.2, the Hummingbird Performance WordPress plugin does not restrict a network‑wide setting to network administrators. An administrator on any single site in a multisite network can change that setting and execute arbitrary code across the entire network, enabling full compromise of all sites and threatening confidentiality, integrity, and availability.

WordPress multisite installations that include the Hummingbird Performance plugin version lower than 3.21.2 are affected. Any site administrator on such a network has the power to influence the setting and trigger remote code execution for all tenant sites.

The CVSS score of 7.2 indicates a high severity Remote Code Execution flaw. The EPSS score is <1%, indicating low probability of exploitation, but the vulnerability can still be exploited by any site‑administrator, requiring no network‑admin privileges. It is not listed in the CISA KEV catalog, and the attack vector is an authenticated privilege escalation within a multisite network.