CVE-2026-75796

This vulnerability breaks WordPress Multisite's fundamental privilege boundary, and the CVSS 7.2 rating badly understates the risk. The core issue isn't a simple IDOR in user management—it's the collapse of an architectural assumption that Multisite relies upon: Site Admins are scoped to their sub-site, Network Admins govern the federation. This flaw lets any Site Admin on ANY sub-site bypass that boundary entirely and impersonate any account, including Network Admin, without lateral movement. They simply call a plugin function from their already-compromised sub-site context. In a network of 50 sub-sites, you have 50 potential attackers who can each own the entire network. The blast radius scales with network size, not plugin popularity. Once a public PoC emerges—this is straightforward enough for automated exploitation—the EPSS will spike. The 3.6.1 fix presumably adds proper authorization checks. Verify those checks are implemented defensively (assume no trust of Site Admin context for network operations) rather than permissively (blacklist specific roles). Specifically, examine whether the check changed from a site-scoped capability like `manage_users` to a network-scoped capability like `manage_network_users`—that single difference is where the vulnerability lives. Audit other plugin functions for cross-site operations without equivalent authorization guards; this is likely a systemic pattern, not an isolated oversight. This is a known recurring bug class in WordPress. The permission API is labyrinthine, documentation is scattered, and developers under deadline pressure reach for the simplest check that 'works' locally without grasping Multisite scope boundaries. WordPress makes the secure path harder to discover than the exploitable one. One critical blind spot: detection is effectively impossible from external data. Site Admins in the WordPress admin panel look structurally identical to single-site administrators—no UI indicator flags that their role context is scope-limited. No logs flag cross-context authorization. The actual prevalence of this vulnerability in the wild is unknowable. Old plugin versions (3.5.1, 3.4.0, and prior) remain exploitable on abandoned sites and will persist until those installs are updated or removed. The zombie fleet guarantees this class of vulnerability outlives its patches.

Reviewed through automated stages and approved by a human before publication.