CVE-2026-15459

Name of the Vulnerable Software and Affected Versions WPMU DEV Dashboard versions prior to 5.0.1

Description An authentication bypass exists on sites not yet connected to the WPMU DEV Hub. Because the site API key used for the WDP-AUTH request signature is empty by default, the signature verified by the validate hash() function can be easily forged. Additionally, the validate nonce() function lacks a replay check, and the remote handler is bound to the public init hook without a capability check. This allows unauthenticated attackers to perform privileged Hub actions, such as logging in as an administrator via SSO, upgrading WordPress core, deleting themes and plugins, or installing and activating a plugin from a remote URL, which can lead to remote code execution.

Recommendations Update the plugin to a version later than 5.0.0. Connect the site to a WPMU DEV account to ensure a non-empty 64-character API key is present.