CVE-2026-15459: WPMU DEV Dashboard Auth Bypass Flaw

CVE-2026-15459 Overview

CVE-2026-15459 is an authentication bypass vulnerability in the WPMU DEV Dashboard plugin for WordPress affecting all versions up to and including 5.0.0. The flaw exists on sites not yet connected to the WPMU DEV Hub, where the site API key used to sign WDP-AUTH requests is empty. This empty key makes the signature verified by validate_hash() trivially forgeable. Unauthenticated attackers can invoke privileged Hub actions, including installing arbitrary plugins from attacker-controlled URLs, resulting in remote code execution.

Critical Impact
Unauthenticated attackers can achieve remote code execution, delete plugins and themes, upgrade WordPress core, or log in as administrator via SSO on unconnected WPMU DEV Dashboard installations.

Affected Products

WPMU DEV Dashboard plugin for WordPress — all versions up to and including 5.0.0
Only sites not connected to a WPMU DEV account (default state after installation) are exploitable
Sites connected to a WPMU DEV account with a non-empty 64-character API key are not affected

Discovery Timeline

2026-08-06 - CVE-2026-15459 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-15459

Vulnerability Analysis

The vulnerability is classified as an Authentication Bypass [CWE-287] in the plugin's remote Hub action handler. The remote handler is bound to the public init hook without any capability check, exposing privileged operations to unauthenticated requests. Attackers who successfully forge a valid WDP-AUTH signature can trigger any Hub action the plugin exposes.

Exploitable actions include installing and activating a plugin from an attacker-supplied URL, which yields remote code execution on the target host. Additional actions permit deleting installed plugins and themes, upgrading WordPress core, and authenticating as an administrator via single sign-on (SSO). The attack complexity is elevated because exploitation requires the site to remain in the unconnected default state.

Root Cause

The root cause is twofold. First, on unconnected sites the API key that seeds the WDP-AUTH HMAC signature is an empty string, allowing an attacker to compute a valid signature for arbitrary requests. Second, version 5.0.0 removed the replay protection previously implemented in validate_nonce(), eliminating a control that would have limited signature reuse. The init binding without a capability gate compounds these issues by exposing the handler to unauthenticated visitors.

Attack Vector

An attacker sends a crafted HTTP request over the network to the target WordPress site, forging the WDP-AUTH signature using the known-empty key. The forged request invokes a Hub action such as plugin installation from a remote URL controlled by the attacker. The plugin fetches and activates the attacker's package, executing arbitrary PHP code in the WordPress process context. See the Wordfence Security Vulnerability ID for technical details.

Detection Methods for CVE-2026-15459

Indicators of Compromise

Unexpected HTTP requests containing the WDP-AUTH header targeting the WordPress init hook endpoint from unauthenticated sources.
Newly installed plugins or themes that were not deployed by administrators, especially those sourced from external URLs.
Unexpected administrator logins originating from SSO flows tied to the WPMU DEV Dashboard plugin.
Modifications to wp-content/plugins/ directory timestamps that do not correlate with legitimate administrative activity.

Detection Strategies

Inspect web server access logs for requests containing WDP-AUTH headers or Hub action parameters from unauthenticated clients.
Monitor WordPress audit logs for plugin install, plugin delete, theme delete, or core upgrade events without a corresponding administrator session.
Alert on file system changes in wp-content/plugins/ and wp-content/themes/ that originate from HTTP-triggered processes.

Monitoring Recommendations

Enable WordPress activity logging plugins to record all administrative actions with source IP attribution.
Forward web server and PHP-FPM logs to a centralized SIEM for correlation of Hub action requests with subsequent file writes.
Track outbound HTTP requests from the WordPress host to detect the plugin fetching attacker-hosted packages.

How to Mitigate CVE-2026-15459

Immediate Actions Required

Update the WPMU DEV Dashboard plugin to the patched version listed in the WPMU DEV Dashboard Changelog.
Connect the site to a valid WPMU DEV account so the API key is populated with a non-empty 64-character value, eliminating the exploitable condition.
If the plugin is not required, deactivate and remove it from all WordPress installations.
Audit wp-content/plugins/ and administrator accounts for unauthorized additions or logins since the plugin was installed.

Patch Information

Refer to the vendor changelog at WPMU DEV Dashboard Changelog for the fixed release. The patch restores signature verification integrity and reinstates replay protection in validate_nonce(). Administrators should verify the installed version after upgrade.

Workarounds

Connect the site to a WPMU DEV account immediately to populate the API key and neutralize the empty-key signature bypass.
Restrict access to the WordPress site using a web application firewall (WAF) rule that blocks unauthenticated requests containing the WDP-AUTH header.
Remove the plugin entirely on installations that are not actively managed through the WPMU DEV Hub.

bash

# Example WAF rule concept: block unauthenticated WDP-AUTH requests
# ModSecurity-style pseudo-rule
SecRule REQUEST_HEADERS:WDP-AUTH "@rx .+" \
    "id:1015459,phase:1,deny,status:403,\
    msg:'Block CVE-2026-15459 WPMU DEV Dashboard unauthenticated WDP-AUTH request'"