CVE-2026-15459: WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validatehash() trivially forgeable; version 5.0.0 additionally removed the replay check in validatenonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions — including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPMU DEV Dashboard plugin for WordPressto a version that resolves this vulnerability.Fixed in 5.0.0 - Configuration
On sites not yet connected to the WPMU DEV Hub (default after installation), ensure the site API key used for WDP-AUTH request signatures is set to a non-empty 64-character value so the validate_hash()/WDP-AUTH verification is not trivially forgeable.
WPMU DEV Dashboard plugin for WordPress site API key used to sign WDP-AUTH requests (64-character API key) = non-empty (64 characters) - Configuration
In affected plugin versions (<= 5.0.0), ensure the validate_nonce() replay protection is restored/enabled so forged/rewound nonces can’t be accepted.
WPMU DEV Dashboard plugin for WordPress validate_nonce() replay check = enabled - Compensating control
Restrict access to the public WordPress init hook handler backing the ?wpmudev-hub= endpoint so unauthenticated users cannot invoke privileged Hub actions (e.g., installing/activating plugins, deleting plugins/themes, upgrading core, or SSO admin login).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15459?
The severity of CVE-2026-15459 is high with a score of 8.1.
What impact does CVE-2026-15459 have on my website?
CVE-2026-15459 allows for authentication bypass leading to arbitrary plugin installation and potentially remote code execution.
How do I fix CVE-2026-15459?
To fix CVE-2026-15459, you should update the WPMU DEV Dashboard plugin to version 5.0.1 or later.
Which versions of WPMU DEV Dashboard are affected by CVE-2026-15459?
CVE-2026-15459 affects all versions of the WPMU DEV Dashboard plugin up to and including 5.0.0.
Is CVE-2026-15459 a common vulnerability?
CVE-2026-15459 is a notable vulnerability that affects WordPress sites using the WPMU DEV Dashboard plugin without an active connection to the WPMU DEV Hub.