When you network activate a plugin on a WordPress multisite network, it runs on every site in the network at once. One vulnerable plugin then exposes every site, and only Super Admins can manage network plugins. Treat the network plugin list as higher risk than any single site's list.
How multisite changes the picture
On a single site, a plugin is one site's problem. On a network, the Super Admin role has capabilities that site administrators lack, including managing network plugins and themes. The WordPress roles documentation lists manage_network_plugins and manage_network_themes among the capabilities available only to Super Admins.
It also states that on a single site installation administrators are in effect Super Admins. On a network the line matters.
Activation scopes
| Scope | What runs | Who decides |
|---|---|---|
| Activated on one site | Only that site | The site's administrator, if allowed |
| Network activated | Every site | The Super Admin |
| Must-use | Every site, always | Whoever controls the files |
WP-CLI tags network activated plugins with the status active-network, so you can list them.
wp plugin list --status=active-network
Why this raises risk
- Reach. A flaw in a network activated plugin affects every site, including ones nobody looks at.
- Privilege. Super Admin accounts control the whole network, so protecting them matters more.
- Forgotten sites. Old or low traffic sites on the network still run the code.
- Update impact. A bad update can break every site at once.
What to do
- List network activated plugins and keep that list short.
- Ask for each one: does every site need this? If not, activate it per site.
- Limit Super Admin accounts to the few people who need them, and use strong sign in with two step authentication.
- Test updates on a staging copy of the network, since a failure is shared.
- Include the network in your inventory, one row per plugin with its scope.
- Review the list on a schedule and remove stale entries.
Agencies hosting many clients on one network
If clients share a network, a plugin chosen for one client lands on all of them. Weigh that against running separate installs, which cost more to maintain but isolate flaws and access. Record the decision and the reason.
You can run the same review on theme activation, since network enabled themes follow similar rules. Safeguard can scan a repository for dependency manifests and produce an SBOM, and there is a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one inventory shows which components run where.
Quick check
Who can manage network plugins?
Super Admins. The roles documentation lists the network plugin capability among Super Admin only capabilities.
How do I list network activated plugins?
Use the WP-CLI plugin list command with the status set to active-network.
Sources
Last reviewed: 19 October 2026.
