The flaw exists in the Malcure Malware Shield WordPress plugin prior to version 19.9.7. When a user with a Subsite Administrator role accesses the wpmr_ajax_request AJAX action, the plugin does not perform an authorization check. This allows the attacker to supply arbitrary file paths and contents, causing the plugin to create or delete files in the network's shared file system. The attacker can therefore place malicious code that the WordPress front‑end can execute, resulting in remote code execution. The vulnerability involves improper authorization and unchecked file operations, which maps to CWE identifiers related to access control and file path manipulation.

Every installation of Malcure Malware Shield version lower than 19.9.7 that is running within a WordPress multisite network is affected. The issue only manifests when a subsite administrator role is granted, as the privileged user is able to send the vulnerable AJAX request. Since the plugin stores data in the shared filesystem, any multisite that shares that location is at risk.

The vulnerability allows remote code execution, a highly consequential outcome. No EPSS score is reported, but the lack of an authorization check means the flaw can be exploited by any subsite administrator without additional configuration changes. The flaw is not listed in the CISA KEV catalog, but that does not mitigate the fact that an attacker can trigger arbitrary file writes or deletions. The risk is therefore high for impacted multisite environments.