CVE-2026-15459
Received Received - Intake

Authentication Bypass in WPMU DEV Dashboard Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Wordfence

Description
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable; version 5.0.0 additionally removed the replay check in validate_nonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions — including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-15459
EUVD
EUVD-2026-53710

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpmu_dev wpmu_dev_dashboard to 5.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WPMU DEV Dashboard plugin for WordPress has an authentication bypass flaw in versions up to 5.0.0. When a site is not connected to the WPMU DEV Hub, the API key used for authentication is empty, allowing attackers to forge signatures. Version 5.0.0 also removed a replay check, enabling unauthenticated attackers to execute privileged actions like installing plugins, deleting files, or gaining admin access via SSO.

Detection Guidance

Check if the WPMU DEV Dashboard plugin version is 5.0.0 or below. Use WordPress admin panel or run: wp plugin list --name=wpmu-dev-dashboard. If installed, verify if the site is connected to WPMU DEV Hub by checking API key presence in plugin settings.

Impact Analysis

Unauthenticated attackers could exploit this to install malicious plugins, delete themes or plugins, upgrade WordPress core, or log in as an administrator via SSO. This could lead to remote code execution, data loss, or complete site takeover. Sites connected to WPMU DEV with a valid API key are not affected.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or loss of sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update the WPMU DEV Dashboard plugin to version 5.0.1 or later immediately. If unable to update, disconnect the site from WPMU DEV Hub or disable the plugin entirely until patched. Review user accounts for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15459. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart