CVE-2026-96896 in Malcure Malware Shield Plugin
Summary
by MITRE • 09/27/2026
The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified within Malcure Malware Shield versions prior to 19.9.7 represents a critical failure in access control mechanisms for WordPress plugins operating on multisite networks. This flaw specifically affects an AJAX action endpoint that fails to verify the authorization status of the requesting user before executing file system operations. In a standard single-site WordPress installation, this might be less severe if only administrators have access, but within a multisite environment, the implications are significantly amplified due to the shared nature of the underlying filesystem and the varying privilege levels assigned to different users across subsites.
The core technical flaw is an insecure direct object reference combined with a missing function check for administrative privileges on specific AJAX endpoints. When a user initiates an AJAX request intended to manage malware scans or clean infected files, the plugin does not adequately validate whether the requester possesses the necessary capabilities defined by WordPress roles and capabilities API. Consequently, any authenticated user who holds at least the subsite administrator role can interact with this endpoint without restriction. This lack of server-side authorization enforcement allows these users to manipulate file paths passed as parameters in the AJAX request, leading to arbitrary file write and delete operations within the network's shared wp-content directory structure.
The operational impact of this vulnerability is severe because it directly facilitates remote code execution through a technique known as web shell upload or modification. By exploiting the ability to write files arbitrarily, an attacker with subsite administrator privileges can place malicious PHP scripts into directories that are accessible via HTTP requests, such as theme folders or plugin directories. Once these backdoors are in place and executed by the web server, the attacker gains full control over the underlying operating system running the WordPress instance. This effectively bypasses all application-level security controls since the code executes with the privileges of the web server process, typically allowing for complete compromise of the hosting environment, data exfiltration, and further lateral movement within the network infrastructure.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, as it involves a failure to enforce proper access control policies on privileged operations. Furthermore, from an offensive security perspective, this flaw maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically the subtechnique for executing arbitrary code via web shells (T1505.003). The ability to write files also relates to CWE-436, which covers Interpretation of Untrusted Input leading to unintended side effects or behavior changes during execution.
Mitigation strategies must focus on immediate remediation and long-term security hardening. Administrators running affected versions should upgrade the Malcure Malware Shield plugin to version 19.9.7 or later immediately, as this release includes patches for the authorization checks. In environments where upgrading is not instantly feasible, administrators can temporarily disable AJAX functionality related to file management if possible, though complete removal of the plugin may be necessary until a patch is applied. Additionally, implementing strict web application firewall rules that monitor and restrict unusual file write operations in wp-content directories can provide an additional layer of defense against exploitation attempts. Regular audits of user roles and capabilities across multisite networks are also recommended to ensure that subsite administrators do not possess unnecessary privileges that could be leveraged for such attacks.