WordPress Core <= 7.1 — Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)

Overview

Advisory ID

dc1ae2c7-1eff-4976-8f88-f0b97a5cf323

Product

WordPress wordpress

Affected

≤7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

Weakness

CWE-862 Missing Authorization

Required access

Unknown

Published

Sep 17, 2026 · updated Nov 13, 2026

Credit

Jesse McNeil

WordPress Core is vulnerable to Missing Authorization via the wp_ajax_activate_plugin() AJAX action in various versions up to, and including, 7.1 due to a missing manage_network_plugins capability check when activating a network-only plugin, and a path-normalization mismatch between is_network_only_plugin() and activate_plugin(). This makes it possible for authenticated attackers with site-administrator access on a Multisite network to network-activate an installed network-only plugin.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to one of the following versions, or a newer patched version: 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.