CVE-2026-96896

Name of the Vulnerable Software and Affected Versions Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin versions prior to 19.9.7

Description An authorization check is missing in an AJAX action, which allows users with a subsite administrator role on a multisite network to write and delete arbitrary files within the network's shared filesystem. This flaw can lead to remote code execution, a situation where an attacker can execute arbitrary commands on the server.

Recommendations Update the plugin to version 19.9.7 or later.