Prior to version 3.21.2, the Hummingbird Performance WordPress plugin does not restrict a network‑wide setting to network administrators. An administrator on any single site in a multisite network can change that setting and execute arbitrary code across the entire network, enabling full compromise of all sites and threatening confidentiality, integrity, and availability.

WordPress multisite installations that include the Hummingbird Performance plugin version lower than 3.21.2 are affected. Any site administrator on such a network has the power to influence the setting and trigger remote code execution for all tenant sites.

Although no CVSS score is supplied, the lack of restriction on the setting represents a severe Remote Code Execution flaw. The EPSS score is not available, but the vulnerability can be exploited by any site‑administrator, requiring no network‑admin privileges. It is not listed in the CISA KEV catalog, and the attack vector is an authenticated privilege escalation within a multisite network.