A critical authorization vulnerability in the Hummingbird Performance plugin allows authenticated site administrators to achieve remote code execution across an entire WordPress multisite network.

This flaw involves improper control of code generation (CWE-94) where the plugin fails to perform necessary capability checks on network-wide settings. While the attack requires administrative privileges on a single sub-site, it permits an attacker to escalate their impact to the entire multisite environment.

Successful exploitation grants an attacker the ability to execute arbitrary code, which can lead to complete compromise of the WordPress multisite environment. With a CVSS score of 7.2, this vulnerability poses a significant risk to data integrity and system availability, potentially allowing unauthorized access to sensitive information across every site hosted on the network.

Immediate Action: Update the Hummingbird Performance plugin to version 3.21.2 or later immediately to resolve the improper access control.

Proactive Monitoring: Review WordPress multisite audit logs for unusual administrative activity or unauthorized modifications to network-wide plugin settings.

Compensating Controls: If immediate patching is not feasible, consider temporarily deactivating the plugin on the multisite network or restricting administrative access to the specific settings page via WAF rules.

Public Exploit Available: No

Given the potential for full network compromise, administrators must prioritize updating the Hummingbird Performance plugin to version 3.21.2. The risk of lateral movement from a single sub-site to the entire network makes this update essential for maintaining the security posture of the WordPress multisite installation.