{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/wpmu-dev/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-15459"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WPMU DEV Dashboard"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WPMU DEV"],"content_html":"\u003cp\u003eThe WPMU DEV Dashboard plugin for WordPress is vulnerable to an authentication bypass (CVE-2026-15459) affecting all versions up to and including 5.0.0. The vulnerability stems from how the plugin handles request signatures when a site has not been connected to the WPMU DEV Hub. In this default state, the site API key is empty, causing the \u003ccode\u003evalidate_hash()\u003c/code\u003e function to accept trivially forgeable signatures. Furthermore, the removal of replay checks in \u003ccode\u003evalidate_nonce()\u003c/code\u003e in version 5.0.0 and the absence of capability checks on the public \u003ccode\u003einit\u003c/code\u003e hook allow unauthenticated actors to execute sensitive administrative functions. This impact includes arbitrary plugin installation from remote URLs, leading to full remote code execution, as well as administrative account takeover via SSO. Sites with an active WPMU DEV account and a populated API key are not susceptible to this specific vector.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain complete control over affected WordPress installations. Potential impacts include remote code execution through the installation of malicious plugins, unauthorized modification of site content (deletion of themes and plugins), unauthorized WordPress core upgrades, and full administrative access via SSO mechanisms. All WordPress sites running WPMU DEV Dashboard versions 5.0.0 or lower that remain disconnected from the WPMU DEV Hub are at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the WPMU DEV Dashboard plugin to the latest version beyond 5.0.0 immediately.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, connect affected sites to the WPMU DEV Hub to populate the API key, thereby mitigating the forgeable signature condition.\u003c/li\u003e\n\u003cli\u003eReview web access logs for anomalous \u003ccode\u003ePOST\u003c/code\u003e requests to WordPress \u003ccode\u003einit\u003c/code\u003e hooks or plugins/dashboard endpoints originating from unexpected sources.\u003c/li\u003e\n\u003cli\u003eAudit existing plugin and theme installations on WordPress environments to identify unauthorized or suspicious additions since the deployment of vulnerable versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T07:22:00Z","date_published":"2026-08-06T07:22:00Z","id":"https://feed.craftedsignal.io/briefs/2026-08-wpmu-dev-auth-bypass/","summary":"An authentication bypass vulnerability in WPMU DEV Dashboard plugin versions 5.0.0 and earlier allows unauthenticated attackers to invoke privileged administrative actions via forged request signatures.","title":"Authentication Bypass in WPMU DEV Dashboard Plugin","url":"https://feed.craftedsignal.io/briefs/2026-08-wpmu-dev-auth-bypass/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-18325"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Forminator Forms (\u003c= 1.56.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WPMU DEV"],"content_html":"\u003cp\u003eThe Forminator Forms - Contact Form, Payment Form \u0026amp; Custom Form Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to flaws in how the plugin handles input validation and field data persistence. The vulnerability exists in all versions up to and including 1.56.1. The root cause lies in the 'Forminator_Core::sanitize_array()' function, which fails to apply filtering to keys prefixed with 'select-', and the 'set_field_data()' function, which incorrectly treats a submitted 'return' member as a trusted internal flag. This combination allows an unauthenticated attacker to bypass security controls to forge and persist an upload field record containing malicious script payloads. When an administrative or authenticated user views the injected content, the payload executes within their browser context, potentially leading to session hijacking, unauthorized administrative actions, or further compromise of the WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's session. In a WordPress environment, this typically results in full administrative account takeover, unauthorized modification of site content, or the injection of additional malicious scripts across the platform. Given the popularity of the Forminator plugin, this vulnerability poses a significant risk to any site running versions 1.56.1 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Forminator Forms plugin to a patched version beyond 1.56.1 immediately to remediate the underlying sanitization flaw.\u003c/li\u003e\n\u003cli\u003eDeploy web application firewall (WAF) rules to inspect POST requests to WordPress form endpoints, specifically looking for anomalous values in 'select-' prefixed keys or unexpected 'return' parameters.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for repeated requests to form submission endpoints originating from unauthorized or suspicious IP addresses that attempt to inject common XSS payloads such as '\u0026lt;script\u0026gt;' tags or 'javascript:' pseudo-protocols.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T05:21:59Z","date_published":"2026-08-06T05:21:59Z","id":"https://feed.craftedsignal.io/briefs/2026-08-cve-2026-18325/","summary":"An unauthenticated stored XSS vulnerability in Forminator Forms plugin versions 1.56.1 and earlier allows attackers to inject and execute arbitrary web scripts via forged upload records.","title":"Stored Cross-Site Scripting in Forminator Forms Plugin for WordPress","url":"https://feed.craftedsignal.io/briefs/2026-08-cve-2026-18325/"}],"language":"en","title":"CraftedSignal Threat Feed - WPMU DEV","version":"https://jsonfeed.org/version/1.1"}