CVE-2026-15459Active Exploitation

MEDIUMCVSS 8.1 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable; version 5.0.0 additionally removed the replay check in validate_nonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions — including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-287

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Patch or workaround signal is available
5 mentions across 5 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
Peaked 4d ago at 1 mentions (2026-08-06); latest day: 1
5 total mentions across 5 days

Deep dive

Activity timeline5 mentions / 5d

Signal classification4 categories

Active Exploitation

240.0%

Disclosure

120.0%

Patch

120.0%

General

120.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-06	1	Disclosure1
2026-08-08	1	Active Exploitation1
2026-08-13	1	Active Exploitation1
2026-08-20	1	Patch1
2026-10-05	1	General1

Full discourse5 posts

Avery J. Parker@averyjparker76d
Patch
Named bug, not vibes. WPMU DEV Dashboard through 5.0.0 (CVE-2026-15459 / CVE-2026-16051): unauthenticated Hub actions, including installing a plugin. That's remote code execution. Patch is 5.0.1. If the site was already popped, the patch does not pull the injector out of the files or t
Post summary
The CVE-2026-15459/CVE-2026-16051 vulnerability allows unauthenticated remote code execution via WPMU DEV Dashboard, fixed in version 5.0.1.
3000042
97 followersView on X
Jordi García@jordigarcia_dev31d
General
WPMU DEV Dashboard fue el vector de compromiso. En dos webs, la infección estaba relacionada con CVE-2026-15459. → Contén la incidencia. → Revisa persistencia y credenciales. https://wpseguridad.com/blog/caso-real-wpmudev-dashboard-infeccion-wordpress/
Post summary
The post reports that the WPMU DEV Dashboard served as the compromise vector for CVE-2026-15459 in two WordPress sites, urging containment and credential checks, with a link to a detailed case study.
0000030
609 followersView on X
CyberAtlas@cyberatlas_ai83d
Active Exploitation
Cyber news updates: Chinese state-sponsored hackers have breached the U.S. Treasury Department, marking it as a 'Major Incident'. Full breakdown: http://cyberatlas.ai/bulletin A few other things worth watching this week: CISA adds three WordPress vulnerabilities (CVE-2026-15459, -28139, -66665) to KEV list Dell RecoverPoint zero-day (CVE-2026-22769) poses critical data privacy risks CERT Polska reports multi-stage cyberattack on Polish energy infrastructure Russian hackers release contact information of 186 US House Democrats AI-driven attacks breach Taiwanese government networks using Mirai-derived botnet #cybersecurity #news #hack
Post summary
The post reports a breach of the U.S. Treasury by Chinese state actors and highlights several CVEs, with CISA’s KEV listing pointing to potential active exploitation of WordPress vulnerabilities, while other incidents are mentioned without detailed exploit or patch information.
00000103
25 followersView on X
Andreas Lang - Sphinx-Flashdesign@Sphinx_Flash89d
Active Exploitation
CVE-2026-15459: WPMU DEV Dashboard <=5.0.0 auth bypass leads to RCE. CVSS 8.1, actively exploited (3,419 attacks in 24h). Patch: 5.0.1. Update now. #infosec #WordPress #websecurity Security researcher Austin Ginder (founder of Anchor Hosting) reported a serious vulnerability in the WPMU DEV Dashboard plugin to the security firm Wordfence. The same day, the vendor WPMU DEV released a patch with version 5.0.1. On 6 August 2026 the vulnerability was officially registered as CVE-2026-15459 in the National Vulnerability Database (NVD) of the US-based NIST and rated with a CVSS score of 8.1 (High). This is a so-called authentication bypass vulnerability – meaning an attacker can completely circumvent the login check and perform actions that should really be reserved for a logged-in administrator. The most dangerous scenario: attackers can install and activate any plugin from a web address they control. Since such a "plugin" can contain arbitrary PHP code, this leads directly to Remote Code Execution (RCE) – the execution of external malicious code on your web server. What's particularly alarming: the flaw is already being actively exploited on a large scale. Within just 24 hours of disclosure, Wordfence blocked 3,419 attacks. The security provider Patchstack classified the vulnerability as "Known to be Exploited" (KEV) – that is, demonstrably already exploited. Details: https://shieldgaps.com/en/news/wpmu-dev-dashboard-500-auth-bypass-enables-rce-actively-exploited-217
Post summary
CVE‑2026‑15459 in WPMU DEV Dashboard allows authentication bypass that leads to remote code execution; it was actively exploited in 3,419 attacks within 24 hours, and a patch (5.0.1) has been released.
00000105
1.1K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-15459 Authentication Bypass and Remote Code Execution in WPMU DEV Dashboard Pl... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15459 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
This is a vulnerability alert for CVE-2026-15459, highlighting an authentication bypass and RCE flaw in the WPMU DEV Dashboard.
00000128
4.1K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-15459

Avery J. Parker[verified]@averyjparkerPatch

The CVE-2026-15459/CVE-2026-16051 vulnerability allows unauthenticated remote code execution via WPMU DEV Dashboard, fixed in version 5.0.1.

CyberAtlas[verified]@cyberatlas_aiActive Exploitation

The post reports a breach of the U.S. Treasury by Chinese state actors and highlights several CVEs, with CISA’s KEV listing pointing to potential active exploitation of WordPress vulnerabilities, while other incidents are mentioned without detailed exploit or patch information.

Andreas Lang - Sphinx-Flashdesign[verified]@Sphinx_FlashActive Exploitation

CVE‑2026‑15459 in WPMU DEV Dashboard allows authentication bypass that leads to remote code execution; it was actively exploited in 3,419 attacks within 24 hours, and a patch (5.0.1) has been released.

Jordi García@jordigarcia_devGeneral

The post reports that the WPMU DEV Dashboard served as the compromise vector for CVE-2026-15459 in two WordPress sites, urging containment and credential checks, with a link to a detailed case study.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

This is a vulnerability alert for CVE-2026-15459, highlighting an authentication bypass and RCE flaw in the WPMU DEV Dashboard.