EUVD-2026-53710
GHSA-82jx-g559-m3rq
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network vector with no authentication matches the public init hook; AC:H reflects the required unconnected-hub deployment condition as the sole exploitation prerequisite.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub - the default state after installation - the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable; version 5.0.0 additionally removed the replay check in validate_nonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions - including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected.
AnalysisAI
Authentication bypass in WPMU DEV Dashboard (WordPress plugin) versions up to and including 5.0.0 enables unauthenticated remote attackers to invoke privileged Hub actions - including remote code execution by installing a plugin from an attacker-controlled URL, takeover of an administrator account via SSO, deletion of plugins and themes, and forced WordPress core upgrades - on any site not yet connected to the WPMU DEV Hub. The default post-installation state is unconnected, meaning every fresh installation is immediately exposed until Hub onboarding is completed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions to both be true: (1) the WPMU DEV Dashboard plugin is installed at any version up to and including 5.0.0, AND (2) the site has not yet been connected to the WPMU DEV Hub, leaving the site API key as an empty string - this is the default state immediately after plugin installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects maximum CIA impact accessible over the network with no authentication, moderated only by AC:H for the deployment-state prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WPMU DEV Dashboard plugin to the first version released after 5.0.0 that addresses this vulnerability - consult the official vendor changelog at https://wpmudev.com/project/wpmu-dev-dashboard/#changelog_all to confirm the exact patched release number, as it was not independently confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your WordPress environment to identify all WPMU DEV Dashboard plugin installations (versions ≤5.0.0) and immediately disable the plugin on unconnected sites by removing plugin files or setting directory permissions to read-only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wpmu Dev Dashboard
View allSame weakness CWE-287 – Improper Authentication
View allShare
External POC / Exploit Code
Leaving vuln.today