Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

Description

The plugin does not check that the user is allowed to install plugins before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared plugin directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Plugins administration menu for subsites, which is not the default.