Authentication Bypass in WPMU DEV Dashboard Plugin

The WPMU DEV Dashboard plugin for WordPress is vulnerable to an authentication bypass (CVE-2026-15459) affecting all versions up to and including 5.0.0. The vulnerability stems from how the plugin handles request signatures when a site has not been connected to the WPMU DEV Hub. In this default state, the site API key is empty, causing the validate_hash() function to accept trivially forgeable signatures. Furthermore, the removal of replay checks in validate_nonce() in version 5.0.0 and the absence of capability checks on the public init hook allow unauthenticated actors to execute sensitive administrative functions. This impact includes arbitrary plugin installation from remote URLs, leading to full remote code execution, as well as administrative account takeover via SSO. Sites with an active WPMU DEV account and a populated API key are not susceptible to this specific vector.

Impact

Successful exploitation allows unauthenticated attackers to gain complete control over affected WordPress installations. Potential impacts include remote code execution through the installation of malicious plugins, unauthorized modification of site content (deletion of themes and plugins), unauthorized WordPress core upgrades, and full administrative access via SSO mechanisms. All WordPress sites running WPMU DEV Dashboard versions 5.0.0 or lower that remain disconnected from the WPMU DEV Hub are at risk.

Recommendation

• Upgrade the WPMU DEV Dashboard plugin to the latest version beyond 5.0.0 immediately.
• If upgrading is not immediately possible, connect affected sites to the WPMU DEV Hub to populate the API key, thereby mitigating the forgeable signature condition.
• Review web access logs for anomalous POST requests to WordPress init hooks or plugins/dashboard endpoints originating from unexpected sources.
• Audit existing plugin and theme installations on WordPress environments to identify unauthorized or suspicious additions since the deployment of vulnerable versions.