WGDashboard CVE-2026-15733

Exploitation targets WGDashboard's web management interface and abuses one of multiple OS command injection sinks (CWE-78) where user input reaches shell execution; success yields root because the dashboard service runs privileged to manage WireGuard. The CVE description states an authenticated attacker is required - i.e., valid dashboard credentials or an active admin session is the gating precondition - which directly conflicts with the supplied CVSS vector's PR:N (unauthenticated); this discrepancy must be verified with the vendor. Limiting factors: network reachability of the dashboard (self-hosted, often not internet-exposed by default), and, per the description, prior authentication. Affected deployments are WGDashboard instances at version ≤4.3.2.

Signals are mostly aligned toward real priority but contain one notable contradiction. The CVSS 3.1 base score is 9.8 with vector AV:N/AC:L/PR:N/UI:N, implying trivial remote unauthenticated exploitation, yet the description explicitly says 'authenticated attackers' - these conflict, and the PR:N in the vector appears inconsistent with the described precondition; verify authentication requirement with the vendor. SSVC reinforces urgency (Exploitation: PoC, Automatable: yes, Technical Impact: total), and a public PoC exists. EPSS is moderate at 1.53% (72nd percentile), which is not alarmingly high; combined with the absence of KEV listing, this suggests exploitation is currently opportunistic/PoC-driven rather than confirmed widespread in-the-wild activity. Net: high-impact, low-complexity, PoC-backed root RCE in a niche but internet-exposable admin panel - treat as high priority for any exposed instance, while recognizing deployment footprint is limited.

An attacker who can reach the WGDashboard web interface (and, per the description, holds a valid dashboard login) submits a request to a vulnerable endpoint with shell metacharacters embedded in a parameter, causing the Flask backend to execute the injected OS command as root. Because a working PoC is public (Stuub's v4.3.2 exploit), an attacker can adapt it directly to drop a reverse shell or persist on the host. Given AC:L, the exploit is reliable and requires no special timing or race conditions.