WordPress WPMU DEV Dashboard Authentication Bypass Flaw

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable; version 5.0.0 additionally removed the replay check in validate_nonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions — including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WPMU DEV Dashboard plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to 5.0.0. The flaw stems from an empty site API key on unconfigured installations, which renders the WDP-AUTH request signature trivially forgeable. Version 5.0.0 compounds the issue by removing replay protection in the validate_nonce() function, while exposing the vulnerable remote handler to the public init hook without capability checks. This means an unauthenticated attacker can forge valid signatures and execute authenticated actions on affected WordPress sites without possessing legitimate credentials. With a CVSS score of 8.1, this vulnerability poses a significant risk to any organization using this popular dashboard plugin, particularly those in the default post-installation state.

Casky.ai's 283 mapped security skills detect the attack patterns underlying this vulnerability by correlating MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify detection signals including: suspicious unauthenticated API requests with forged signatures hitting the init hook, absence of valid nonce tokens in requests, and privilege escalation attempts bypassing normal WordPress capability checks. Claude's extended reasoning capabilities help practitioners recognize the attack chain—an adversary crafting requests with empty-key signatures, exploiting the missing replay validation, and accessing admin functionality without credentials. The platform would flag anomalous WDP-AUTH header patterns and correlate them with CWE-287 (Improper Authentication) weakness indicators, enabling security teams to distinguish legitimate traffic from exploitation attempts and prioritize remediation of this actively exploitable vulnerability.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15459.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-15459

Casky has 283 skills that investigate the attack patterns behind CVE-2026-15459. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn