A missing authorization check in the Really Simple Security WordPress plugin allows a subsite administrator on a multisite network to install an arbitrary plugin from a user‑supplied URL through the "rsp_upgrade_install_plugin" endpoint. Because the installed plugin code is executed in the network‑shared Really Simple Security directory, an attacker can place and run malicious code affecting the entire network, leading to full compromise of the site. The vulnerability stems from the absence of an access control check (a classic improper authorization flaw).

The affected product is the Really Simple Security WordPress plugin, versions 9.8.0 and earlier. The issue manifests in a multisite WordPress installation when the network administrator has enabled the plugin installation menu for subsites—a setting that is not enabled by default.

Exploit requires a subsite administrator with the capability to use the plugin’s installation menu, which in turn requires the network administrator to have enabled that feature. Although the Exact Percentile EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the ability to install code in a shared directory gives an exploitable remote code execution path. The lack of a mandatory authorisation check and the capability offered to subsite admins make the attack vector realistic in environments where the plugin installation menu is enabled. The risk level is therefore high for multisite networks that have this setting active, while it is lower if the feature remains disabled.