CVE-2026-15459

HighCVSS 8.1

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

41th percentile - higher than 41% of all known CVEs

Summary

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 5.0.0. On sites not connected to the WPMU DEV Hub, the API key is empty, making the signature trivially forgeable; version 5.0.0 also removed the replay check. This allows unauthenticated attackers to invoke privileged actions, including installing plugins from attacker-supplied URLs (leading to RCE), deleting plugins, upgrading WordPress, or logging in as admin.

Risk Assessment

Critical risk of full WordPress site compromise, including remote code execution and privilege escalation.

Recommendation

Update the WPMU DEV Dashboard plugin to a version newer than 5.0.0 immediately or connect the site to a WPMU DEV account to set a non-empty API key. Additionally, restrict access to the admin panel.

Other vulnerabilities in WPMU DEV Dashboard

CVE-2026-76581Critical
The WPMU DEV Dashboard plugin for WordPress up to version 5.0.1 is vulnerable to Authentication Bypass due to inconsistent HMAC message construction between the `wdpsso_step1` and `wdpsso_step2` AJAX actions. An unauthenticated attacker can obtain a valid HMAC from step 1 and replay it to step 2, resulting in an authenticated administrator session.

Original NVD description (English source)

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable; version 5.0.0 additionally removed the replay check in validate_nonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions — including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected.