The Malcure Malware Shield plugin, prior to version 19.9.7, fails to verify the user’s privileges when processing the wpmr_ajax_request AJAX action. Subsite administrators on a WordPress multisite network can exploit this missing authorization check to submit arbitrary file paths and content, allowing the plugin to create or delete files in the shared network filesystem. By placing malicious PHP code into a writable location, an attacker can cause the site to execute that code, resulting in remote code execution. This flaw maps to improper authorization and unchecked file operations.

Any WordPress multisite installation using Malcure Malware Shield version below 19.9.7 is affected. The vulnerability manifests only for users granted the Subsite Administrator role, as these users can trigger the vulnerable AJAX endpoint. Because the plugin writes to a shared filesystem accessible by all sites in the network, every subsite’s filesystem is at risk when the plugin is enabled.

The CVSS score of 7.2 signals a high severity, while the EPSS score of less than 1 % indicates a low but non‑negligible likelihood of exploitation. The attack does not require additional configuration changes – any subsite administrator can exercise the flaw by sending the insecure AJAX request. Although the vulnerability is not listed in the CISA KEV catalog, its ability to produce remote code execution through file creation or deletion poses a significant risk to all impacted multisite environments.