CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable; version 5.0.0 additionally removed the replay check in validate_nonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions — including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected.

• CWE-287

• https://wpmudev.com/project/wpmu-dev-dashboard/#changelog_all
• https://www.wordfence.com/threat-intel/vulnerabilities/id/75c2b82e-cf1c-4db2-811c-82d05c6a1212?source=cve

Published

Aug 6, 2026

Last Modified

Aug 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15449A time-of-check to time-of-use (TOCTOU) flaw in the illumos …5.8
• CVE-2026-1545A weakness has been identified in itsourcecode School Manage…9.8
• CVE-2026-15450The Nex Forms – Ultimate Form Builder – Lite plugin for Word…8.1
• CVE-2026-15452The Smash Balloon Social Photo Feed – Easy Social Feeds Plug…4.7
• CVE-2026-15457The Kirki – Freeform Page Builder, Website Builder & Customi…4.9
• CVE-2026-15458The SEO Booster plugin for WordPress is vulnerable to generi…4.9
• CVE-2026-1546A security vulnerability has been detected in jishenghua jsh…9.8
• CVE-2026-15464The WP Hotel Booking plugin for WordPress is vulnerable to S…6.4
• CVE-2026-15467A flaw was found in the trustyai-service-operator's LMEvalJo…8.1
• CVE-2026-1547A vulnerability was detected in Totolink A7000R 4.1cu.4154. …9.8
• CVE-2026-15470A vulnerability has been found in Eleveo Call Recording Soft…4.3
• CVE-2026-15471A vulnerability was found in Eleveo Call Recording Software …4.3