Executive brief
WPMU DEV Dashboard is a WordPress plugin that manages updates and plugin installations through a remote management interface. The plugin fails to verify the authenticity and integrity of packages before installation and does not prevent replay attacks, allowing an attacker with access to the account API key to install and execute arbitrary code on the WordPress site.
Technical details
The vulnerability is a code execution flaw caused by improper validation of remote install requests in the wpmudev-updates plugin. The plugin authenticates Hub requests using an account-wide HMAC (SHA-256) but fails to verify the cryptographic signature of the downloaded packages and does not implement nonce validation to prevent replay attacks. An attacker possessing the account API key (obtainable from leaked databases, backups, or wp-config.php) can craft a signed request to install an arbitrary .zip package, which is downloaded and executed without integrity checks. The attack requires the account API key but does not require WordPress authentication, and the same request can be replayed indefinitely to re-execute the payload. Patches are available in version 5.0.1 and later.
Affected products
- WPMU DEV Dashboard before 5.0.1
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: Fixed in version 5.0.1