CVE-2026-15459: 
WordPress vulnerability analysis and mitigation

CVE-2026-15459 is an authentication bypass vulnerability in the WPMU DEV Dashboard plugin for WordPress, affecting all versions up to and including 5.0.0. The flaw allows unauthenticated attackers to forge request signatures and invoke privileged administrative Hub actions on sites not yet connected to a WPMU DEV account — the default state after installation. It was published on August 6, 2026, with a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory). Sites that have connected to a WPMU DEV account and possess a non-empty 64-character API key are not affected.

The root cause is improper authentication (CWE-287): on freshly installed, unconnected sites, the API key used to sign WDP-AUTH requests is empty, making the HMAC-style signature verified by validate_hash() trivially forgeable by any attacker. Version 5.0.0 compounded the issue by removing the replay protection check in validate_nonce(), and the remote handler is registered on the public WordPress init hook with no capability check, meaning no authentication or authorization is enforced before privileged actions are executed (GitHub Advisory). The combination of a predictable (empty) signing key, absent replay protection, and a publicly accessible handler creates a complete authentication bypass without requiring any credentials or user interaction.

Successful exploitation allows an unauthenticated remote attacker to invoke any privileged Hub action, including installing and activating a plugin from an attacker-supplied URL (leading to remote code execution), deleting existing plugins and themes, upgrading WordPress core to a potentially malicious version, or logging in as an administrator via SSO. This results in full compromise of confidentiality, integrity, and availability of the affected WordPress site, and could serve as a foothold for lateral movement within shared hosting environments or internal networks (GitHub Advisory).

1. Reconnaissance: Enumerate internet-facing WordPress sites running the WPMU DEV Dashboard plugin (versions ≤ 5.0.0) using tools like WPScan, Shodan, or Censys. Identify sites that have not yet been connected to a WPMU DEV Hub account (i.e., sites in the default post-installation state with an empty API key).
2. Forge the WDP-AUTH signature: Since the API key is empty on unconnected sites, compute a valid WDP-AUTH HMAC signature using an empty string as the key. This produces a trivially forgeable signature that will pass validate_hash() validation.
3. Bypass replay protection (v5.0.0): On version 5.0.0, the validate_nonce() replay check has been removed, so no nonce tracking is required. Craft a request with any nonce value.
4. Invoke a privileged Hub action: Send an HTTP request to the publicly accessible remote handler (bound to the init hook) with the forged signature and a chosen privileged action payload — for example, specifying an attacker-controlled plugin URL for installation and activation.
5. Achieve remote code execution: The server installs and activates the malicious plugin from the attacker-supplied URL, executing arbitrary PHP code on the WordPress server. Alternatively, trigger the SSO login action to gain administrator-level access to the WordPress dashboard (GitHub Advisory).

• Network: Unexpected HTTP POST requests to the WordPress init-bound remote handler endpoint with WDP-AUTH headers containing signatures computed with an empty key; requests originating from unknown or suspicious IP addresses targeting /wp-admin/ or plugin-specific endpoints.
• Logs: WordPress access logs showing requests to the WPMU DEV Dashboard remote handler from unauthenticated sessions; PHP error logs indicating plugin installation or activation events not initiated by a logged-in administrator.
• File System: Newly installed or activated plugins in wp-content/plugins/ not recognized by site administrators; web shells or malicious PHP files introduced via attacker-supplied plugin packages.
• WordPress Activity: Unexpected administrator account sessions in WordPress authentication logs; sudden changes to installed plugins, themes, or WordPress core version without corresponding admin activity.

The primary mitigation is to connect the WordPress site to a WPMU DEV account, which populates the 64-character API key and prevents signature forgery — sites with a non-empty API key are not affected by this vulnerability (GitHub Advisory). Administrators should also update the WPMU DEV Dashboard plugin to a patched version once released; the changelog is available at the WPMU DEV project page. As an additional control, restrict network access to the WordPress admin interface and monitor for unexpected plugin installations or administrator logins. If the plugin is not actively needed, consider deactivating or removing it until a patch is available.

The vulnerability was flagged by Wordfence's threat intelligence team, which published a dedicated entry in their vulnerability database (GitHub Advisory). Beyond the initial disclosure and aggregation by vulnerability tracking services (VulDB, Vulners, CIRCL), no significant public researcher commentary or social media discussion has been identified as of the disclosure date.