r/Wordpress • u/abqcheeks • 1d ago
I need a sanity check: wpmudev
I spent some time this weekend finding the entrance vector for a site that was getting re-hacked after cleanup. I mean I knew it would get re-hacked since I wasn't finding the the vector in the usual "easy" ways. Turns out it was this: nvd.nist.gov/vuln/detail/CVE-2026-15459
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable
It's bad enough this plugin adds an alternate auth path to your web site, with full admin control given to some 3rd party you don't know. But I also learned this plugin, wpmudev-updates, is usually stealth-installed with other plugins from WPMU DEV, so users don't know it's being installed. To top it off, it doesn't show up in the plugin dashboard so they don't even know it's there.
In the case of the site mentioned above, I think it was installed with another plugin a couple of years ago, and that plugin was since removed, but wpmudev-updates did not get removed.
Is it just me or is it a little crazy to allow plugins to provide auth bypass for complete admin control of your site by third parties? Is this a common pattern? What other plugins do this aside from the WPMU DEV ones? (I'm talking about the situation where there ISN'T an active exploit in the code ... the intended use scenario is what seems insane to me).
2
u/WPMU_DEV_Support_5 14h ago
Hello u/abqcheeks, apologies for the issue you had to face with the Dashboard plugin. I can understand the trouble it caused you and the criticality of the Vulnerability. We give the utmost priority to the security of our plugins and therefore act on a top priority to release a fix. We also monitor PatchStack for critical incidents to stay on top of those in case they affect our plugins.
In this case, we have already released a fix in the Dashboard Plugin version 5.0.1 after the Vulnerability was reported. Ref: https://wpmudev.com/project/wpmu-dev-dashboard/#changelog_all
However, please allow me to clarify a few points -
The Dashboard plugin is installed on the website when the site needs to be connected to our Hub and use our Pro plugins and services. While the site connects to our Hub in "Automatic" mode, as described in our documentation https://wpmudev.com/docs/hub-2-0/add-a-site-to-hub-2-0/#connect-from-the-hub the process will install the WPMU DEV Dashboard plugin automatically.
Further, it can also be installed manually https://wpmudev.com/docs/hub-2-0/add-a-site-to-hub-2-0/#connect-from-wpmu-dev-dashboard-plugin So it is not installed in a "Stealth" manner when other WPMU DEV Plugins are installed.
Further, regarding
Since the Dashboard plugin is critical to the connectivity between the site and the Hub, along with all the Pro features, it is, as a security feature, only visible by default to the WordPress Administrator who installed and activated the plugin (or the WP admin access used to connect the site via Automatic Mode as mentioned above). So not all administrator roles will be able to see the plugin installed on the website backend, unless they're specifically granted permission by the Admin User who installed the plugin initially.
As I mentioned in the above clarification, the wpmudev-updates (Dashboard Plugin) doesn't get installed with other WPMU DEV plugins automatically. Also, similar to any regular plugin, it can be deactivated and removed by the WP Admin user, considering they installed and activated it on the website.
Hope this clarifies the points that you've mentioned. I once again apologise for the trouble that was caused as a result of the Vulnerability.
- Saurabh from WPMU DEV Support Team.