What is the CVSS score of CVE-2026-16051?

CVE-2026-16051 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 22.0%.

Which versions of WPMU DEV Dashboard are affected by CVE-2026-16051?

The WPMU DEV Dashboard WordPress plugin (versions before 5.0.1) contains a critical remote code execution vulnerability.. A patch is available.

Is there a public PoC exploit available for CVE-2026-16051?

Yes, a public proof-of-concept exploit is available for CVE-2026-16051. Prioritise patching immediately. EPSS: 22.0%.

How to fix or mitigate CVE-2026-16051?

Within 24 hours, identify and inventory all WordPress installations using the WPMU DEV Dashboard plugin (wpmudev-updates) and document their current versions to establish baseline exposure. Within 7 days, update all instances to version 5.0.1 or later; if immediate patching is infeasible, disable remote management features in the plugin to reduce the attack surface. Within 30 days, conduct a comprehensive security review of all affected systems to detect unauthorized access or code execution that may have occurred during the vulnerability window.

WPMU DEV Dashboard CVE-2026-16051

EUVD-2026-57085 CRITICAL

Code Injection (CWE-94)

2026-08-12 WPScan

GHSA-9hq3-gc69-h95q

WordPress RCE Code Injection Wpmudev Updates Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network RCE with no attacker auth or user interaction (PR:N/UI:N) but AC:H because a valid signed management request must be captured or replayed; full C/I/A impact via code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:34 vuln.today

CVSS changed

Aug 12, 2026 - 20:22 NVD

9.8 (CRITICAL)

Patch available

Aug 12, 2026 - 07:16 EUVD

CVE Published

Aug 12, 2026 - 06:00 cve.org

CRITICAL 9.8

CVE Published

Aug 12, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).

AnalysisAI

Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).

Technical ContextAI

wpmudev-updates is the WPMU DEV Dashboard plugin, which connects self-hosted WordPress sites to WPMU DEV's cloud service (The Hub) to manage plugin/theme installations and updates remotely. That management channel accepts signed requests instructing the site to fetch and install packages. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the install routine trusts the delivered package without cryptographic integrity verification of the payload, and the request-authentication scheme lacks anti-replay protection (no nonce/timestamp binding), so a valid signature can be reused. The CPE cpe:2.3:a:unknown:wpmudev-updates:*:*:*:*:*:*:*:* confirms the affected package name, with the vendor namespace unresolved in the NVD CPE dictionary.

RemediationAI

Vendor-released patch: upgrade wpmudev-updates to version 5.0.1 or later, which adds package integrity verification and replay protection to the remote management interface; this is the primary and recommended fix (see https://wpscan.com/vulnerability/8dae5fbf-2e9d-4978-b97d-a20e076cd309/). If immediate upgrade is not possible, disconnect the site from the WPMU DEV Hub / remote management to close the exploited channel, accepting the trade-off of losing centralized remote management and updates until reconnected. As additional compensating controls, restrict or monitor the plugin's management endpoints at the web/WAF layer and review recently installed plugins/themes for unexpected packages that may indicate a prior forged or replayed install; note that WAF filtering of legitimately-signed requests is imperfect and not a substitute for the patch.