WPMU DEV - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/wpmu-dev/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 06 Aug 2026 07:22:00 +0000Authentication Bypass in WPMU DEV Dashboard Pluginhttps://feed.craftedsignal.io/briefs/2026-08-wpmu-dev-auth-bypass/Thu, 06 Aug 2026 07:22:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-wpmu-dev-auth-bypass/An authentication bypass vulnerability in WPMU DEV Dashboard plugin versions 5.0.0 and earlier allows unauthenticated attackers to invoke privileged administrative actions via forged request signatures.The WPMU DEV Dashboard plugin for WordPress is vulnerable to an authentication bypass (CVE-2026-15459) affecting all versions up to and including 5.0.0. The vulnerability stems from how the plugin handles request signatures when a site has not been connected to the WPMU DEV Hub. In this default state, the site API key is empty, causing the validate_hash() function to accept trivially forgeable signatures. Furthermore, the removal of replay checks in validate_nonce() in version 5.0.0 and the absence of capability checks on the public init hook allow unauthenticated actors to execute sensitive administrative functions. This impact includes arbitrary plugin installation from remote URLs, leading to full remote code execution, as well as administrative account takeover via SSO. Sites with an active WPMU DEV account and a populated API key are not susceptible to this specific vector.

Impact

Successful exploitation allows unauthenticated attackers to gain complete control over affected WordPress installations. Potential impacts include remote code execution through the installation of malicious plugins, unauthorized modification of site content (deletion of themes and plugins), unauthorized WordPress core upgrades, and full administrative access via SSO mechanisms. All WordPress sites running WPMU DEV Dashboard versions 5.0.0 or lower that remain disconnected from the WPMU DEV Hub are at risk.

Recommendation

  • Upgrade the WPMU DEV Dashboard plugin to the latest version beyond 5.0.0 immediately.
  • If upgrading is not immediately possible, connect affected sites to the WPMU DEV Hub to populate the API key, thereby mitigating the forgeable signature condition.
  • Review web access logs for anomalous POST requests to WordPress init hooks or plugins/dashboard endpoints originating from unexpected sources.
  • Audit existing plugin and theme installations on WordPress environments to identify unauthorized or suspicious additions since the deployment of vulnerable versions.
]]>highadvisoryStored Cross-Site Scripting in Forminator Forms Plugin for WordPresshttps://feed.craftedsignal.io/briefs/2026-08-cve-2026-18325/Thu, 06 Aug 2026 05:21:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-cve-2026-18325/An unauthenticated stored XSS vulnerability in Forminator Forms plugin versions 1.56.1 and earlier allows attackers to inject and execute arbitrary web scripts via forged upload records.The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to flaws in how the plugin handles input validation and field data persistence. The vulnerability exists in all versions up to and including 1.56.1. The root cause lies in the 'Forminator_Core::sanitize_array()' function, which fails to apply filtering to keys prefixed with 'select-', and the 'set_field_data()' function, which incorrectly treats a submitted 'return' member as a trusted internal flag. This combination allows an unauthenticated attacker to bypass security controls to forge and persist an upload field record containing malicious script payloads. When an administrative or authenticated user views the injected content, the payload executes within their browser context, potentially leading to session hijacking, unauthorized administrative actions, or further compromise of the WordPress environment.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's session. In a WordPress environment, this typically results in full administrative account takeover, unauthorized modification of site content, or the injection of additional malicious scripts across the platform. Given the popularity of the Forminator plugin, this vulnerability poses a significant risk to any site running versions 1.56.1 or earlier.

Recommendation

Prioritized, concrete actions for detection engineering teams:

  • Update the Forminator Forms plugin to a patched version beyond 1.56.1 immediately to remediate the underlying sanitization flaw.
  • Deploy web application firewall (WAF) rules to inspect POST requests to WordPress form endpoints, specifically looking for anomalous values in 'select-' prefixed keys or unexpected 'return' parameters.
  • Audit web server access logs for repeated requests to form submission endpoints originating from unauthorized or suspicious IP addresses that attempt to inject common XSS payloads such as '<script>' tags or 'javascript:' pseudo-protocols.
]]>highadvisory