Wpmudev Updates
Monthly
Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).
Remote code execution in the WPMU DEV Dashboard (wpmudev-updates) WordPress plugin before 5.0.1 allows an attacker who can obtain or replay a single valid signed management request to push and execute arbitrary code on the site. The plugin's remote management interface installs packages without verifying their integrity and without replay protection, so a captured legitimate management call can be reused to install an attacker-controlled package. WPScan reports publicly available exploit code and the plugin scores CVSS 9.8; EPSS is elevated at 22%, but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).