A recently disclosed vulnerability (CVE-2026-15459) affects the WPMU DEV Dashboard plugin for WordPress and may allow an unauthenticated remote attacker to bypass authentication and perform privileged administrative actions.
Severity level:
CVSS Score: 8.1/High.
Description:
CVE-2026-15459 is an authentication bypass vulnerability in the WPMU DEV Dashboard plugin for WordPress. An unauthenticated attacker can exploit the flaw on sites that have not been connected to the WPMU DEV Hub to perform privileged actions, including installing malicious plugins, gaining administrator access, and potentially achieving remote code execution.
Affected Versions:
- WPMU DEV Dashboard Plugin for WordPress versions 5.0.0 and earlier.
Impact:
Successful exploitation may allow attackers to bypass authentication and gain administrative access to the WordPress site.
Resolution:
- Update the WPMU DEV Dashboard plugin to the latest available version.
- Ensure the website is connected to the WPMU DEV Hub, generating a valid API key used for authentication verification.
- Review installed plugins, themes, and administrator accounts for unauthorized changes.
Mitigations:
- Connect affected sites to the WPMU DEV Hub immediately.
- Restrict access to WordPress administrative interfaces.
- Monitor for unexpected plugin installations, theme changes, and administrator account creation.
- Review web server and WordPress logs for suspicious requests targeting the ?wpmudev-hub= endpoint.
- Remove any unauthorized plugins, themes, or users discovered during review.
Reference:
UIT Information Security