Description

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-04T07:17:08.937Z",
  "pubdate": "2026-09-04T07:17:08.937Z",
  "executiveSummary": "The Hummingbird Performance WordPress plugin, in versions prior to 3.21.2, is affected by an authorization bypass vulnerability.\nThis flaw resides in the improper access control of network-wide settings within WordPress multisite environments.\nThe vulnerability allows an authenticated administrator of an individual site—who should typically be restricted to their own site's scope—to modify global plugin configurations.\nBy manipulating these settings, a malicious actor can achieve remote code execution across the entire network, compromising all sites hosted on the multisite instance.\nThis represents a critical security risk, as the integrity, confidentiality, and availability of the entire network are at stake regardless of the attacker's restricted initial privileges.\nExploitation requires administrative access to at least one sub-site within the network, but no specialized knowledge beyond standard administrative functions of the plugin is necessary.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate authorization check when handling sensitive network-wide configurations in the Hummingbird Performance plugin.\nIn a WordPress multisite architecture, network-wide settings are intended to be accessible only by Super Administrators (Network Admins). The plugin fails to validate whether the user performing the request possesses the 'manage_network_options' capability or the equivalent super-admin status.\nInstead, the backend logic erroneously validates the user session based on local site-level administrative privileges, allowing sub-site admins to interact with endpoints reserved for network-wide administrative tasks.\nThe attack flow proceeds as follows: An attacker with administrator privileges on a single site authenticates to the WordPress dashboard. By crafting requests or navigating to specific admin endpoints managed by the Hummingbird plugin, the attacker bypasses the intended boundary constraints.\nBecause the plugin allows the modification of settings that affect the entire installation, the attacker can leverage these hooks to inject malicious code or overwrite configurations that result in server-side execution.\nThe vulnerable component is the configuration management logic within the plugin that fails to verify the network-level context of the request. Since the plugin's settings interact with server-side files or database options that influence runtime behavior, the unauthorized change of these parameters allows the attacker to execute arbitrary code.\nThe payload behavior involves the manipulation of plugin parameters that define global optimization, caching, or file processing settings. By supplying crafted input to these fields, an attacker can influence the plugin's interaction with the filesystem or database to achieve code execution under the context of the web server process.\nThe post-exploitation impact is severe, granting the attacker full control over the multisite network, effectively elevating privileges from a single-site administrator to a network-wide super-administrator with the ability to execute system-level commands or inject persistent backdoors across all constituent sites."
}