Vulnerability · Published Sep 27, 2026 · Assigned by WPScan

CVE-2026-96896Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request

High 7.2

In plain English

A high-severity missing authorization in Malcure Malware Shield — Removal, Repair, Monitor from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.4%top 67.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Malcure Malware Shield — Removal, Repair, Monitor	0 – before 19.9.7

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/7ab467f9-4340-464c-a436-978a5acbad3a/ exploit, vdb-entry, technical-description