Description

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-27T06:16:57.030Z",
  "pubdate": "2026-08-27T06:16:57.030Z",
  "executiveSummary": "The Defender Security WordPress plugin contains a critical access control vulnerability affecting multisite network configurations.\nThe vulnerability is characterized as an Improper Authorization flaw, where network-wide settings are inadequately protected against site-level administrators.\nThis vulnerability allows an authenticated user with administrative privileges on a single sub-site within a WordPress multisite environment to modify global plugin settings.\nBy manipulating these network-wide settings, an attacker can achieve arbitrary code execution across the entire multisite installation.\nThis poses a severe risk to the confidentiality, integrity, and availability of the entire network, as the attacker effectively bypasses the security boundaries between sub-sites and the network root.\nExploitation requires administrative access to at least one sub-site, but does not require super-administrator or network-level credentials, making this a high-impact escalation vector.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authorization checks within the Defender Security plugin's settings management interface.\nIn a WordPress multisite architecture, administrative tasks that affect the global state of the network should be restricted exclusively to users possessing the 'manage_network_options' capability or equivalent super-admin privileges.\nThe Defender Security plugin failed to enforce this check, instead defaulting to an authorization model that permitted site-level administrators to access and modify global configuration parameters via the plugin's administration dashboard.\nThe attack flow commences when a malicious actor, authenticated as a site administrator, navigates to the Defender Security plugin settings page.\nDue to the lack of server-side validation regarding the user's role relative to the multisite network, the plugin accepts requests to change global settings from non-privileged sub-site administrators.\nThe attacker can leverage these unrestricted settings—specifically those allowing for file uploads, custom security rule injections, or direct modification of plugin behaviors—to inject malicious PHP code into the environment.\nOnce the payload is saved as a network-wide setting, the plugin’s execution logic triggers the malicious code, leading to arbitrary code execution (ACE) in the context of the web server.\nBecause the execution occurs at the network level, the attacker gains full control over the entire multisite ecosystem, including the ability to compromise the database, access files belonging to other sub-sites, and potentially pivot to the underlying server operating system.\nThe vulnerability affects all versions of the Defender Security plugin prior to 6.2.0. The exploit does not require physical access or interaction from a super-administrator; it is purely a logical flaw in the plugin's authentication handler.\nPost-exploitation impact includes complete network compromise, potential exfiltration of sensitive site data across all sub-domains, and the persistence of backdoors within the plugin's configuration files or the wider WordPress directory structure."
}