WPMU DEV Dashboard CVE-2026-15459

Exploitation requires two specific conditions to both be true: (1) the WPMU DEV Dashboard plugin is installed at any version up to and including 5.0.0, AND (2) the site has not yet been connected to the WPMU DEV Hub, leaving the site API key as an empty string - this is the default state immediately after plugin installation. Sites that have completed Hub onboarding with a non-empty 64-character API key are not exploitable regardless of plugin version. The CVSS PR:N confirms no authentication is required from the attacker side; AC:H reflects the deployment-state prerequisite. The limiting factor is the Hub connection status: a connected site is immune. Non-limiting factors include: no user interaction is needed, no specific WordPress configuration is required beyond the plugin being active, and the handler is exposed on all WordPress URLs (not restricted to admin paths), making the attack surface broad on vulnerable sites.

The NVD-assigned CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects maximum CIA impact accessible over the network with no authentication, moderated only by AC:H for the deployment-state prerequisite. The AC:H classification is technically accurate - exploitation requires the site to be unconnected - but is operationally misleading: unconnected is the default state immediately after installation, meaning every newly installed or recently migrated site is in the vulnerable window. The absence of any EPSS data, KEV listing, and public POC means exploitation cannot be confirmed in the wild; however, the forgeable-empty-key mechanism is conceptually trivial and does not require advanced capability. Real-world risk is elevated compared to what the AC:H label implies, particularly because the WPMU DEV Dashboard's install-plugin action provides a direct, reliable path to RCE. Organizations should treat this as functionally high-risk for any unconnected installation rather than discounting it on AC:H grounds. No conflicting signals were found, but the absence of EPSS data and POC references limits precision on exploitation probability.

An attacker scans for WordPress sites running WPMU DEV Dashboard by probing for known plugin file paths, then crafts a WDP-AUTH-signed HTTP request using an empty API key - producing a valid HMAC that validate_hash() will accept - and submits it to the target site's public WordPress request handler. Because the init hook fires before any capability check and version 5.0.0 removed nonce replay protection, the handler processes the request as a legitimate Hub command, installing and activating an attacker-supplied plugin ZIP containing arbitrary PHP code, achieving full server-side code execution. No POC has been publicly referenced at time of analysis, but the attack mechanism is mechanically straightforward given the disclosed root cause.