A missing authorization check in the Really Simple Security WordPress plugin allows a subsite administrator on a multisite network to install an arbitrary plugin from a user-supplied URL through the 'rsp_upgrade_install_plugin' endpoint. Because the installed plugin code is executed in the network-shared Really Simple Security directory, an attacker can place and run malicious code affecting the entire network, leading to full compromise of the site. The vulnerability stems from the absence of an access control check (a classic improper authorization flaw).

The affected product is the Really Simple Security WordPress plugin, versions 9.8.0 and earlier. The issue manifests in a multisite WordPress installation when the network administrator has enabled the plugin installation menu for subsites—a setting that is not enabled by default.

Exploit requires a subsite administrator with the capability to use the plugin’s installation menu, which in turn requires the network administrator to have enabled that feature. The CVSS score is 6.6, and the EPSS score is 0.00147, indicating a low but non‑zero probability of exploitation. Because the plugin installs code into a network‑shared directory reserved for network administrators, the vulnerability provides an opportunity for remote code execution across the multisite network. The lack of a mandatory authorization check and the administrator capability make the attack vector realistic in environments where the plugin installation menu is enabled. The risk level remains high for multisite networks with this setting active, while it is lower if the feature remains disabled.