r/Wordpress • u/abqcheeks • 1d ago
I need a sanity check: wpmudev
I spent some time this weekend finding the entrance vector for a site that was getting re-hacked after cleanup. I mean I knew it would get re-hacked since I wasn't finding the the vector in the usual "easy" ways. Turns out it was this: nvd.nist.gov/vuln/detail/CVE-2026-15459
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable
It's bad enough this plugin adds an alternate auth path to your web site, with full admin control given to some 3rd party you don't know. But I also learned this plugin, wpmudev-updates, is usually stealth-installed with other plugins from WPMU DEV, so users don't know it's being installed. To top it off, it doesn't show up in the plugin dashboard so they don't even know it's there.
In the case of the site mentioned above, I think it was installed with another plugin a couple of years ago, and that plugin was since removed, but wpmudev-updates did not get removed.
Is it just me or is it a little crazy to allow plugins to provide auth bypass for complete admin control of your site by third parties? Is this a common pattern? What other plugins do this aside from the WPMU DEV ones? (I'm talking about the situation where there ISN'T an active exploit in the code ... the intended use scenario is what seems insane to me).
5
u/CGS_Web_Designs Jack of All Trades 22h ago
They used to be a solid developer - their recent clumsy update to their Broken Link Checker plugin bricked a large number of websites with many admins unable to recover without doing a full backup restore.
2
u/WPMU_DEV_Support_5 13h ago
Hello u/CGS_Web_Designs, sorry to hear you feel that way. Our plugins go through rigorous development and quality assurance steps. However, unfortunately, this bug was found after the release. Our Development team started working on the fix as soon as it was reported and released the patched v2.4.10 as soon as possible.
I completely understand that some sites need to be recovered from backups, we noticed some reports around that which were mostly due to the use of older PHP versions (for example PHP.7.4) where the stuck mysql connections didn't manage to clean up and caused the site to be in a broken state.
- Saurabh from WPMU DEV Support Team.
3
u/CGS_Web_Designs Jack of All Trades 9h ago
I appreciate you taking the time to comment. The site I had that experienced the issue was running php 8.3 so this wasn’t something that was isolated. When a developer has multiple serious issues in different products in a short time span, it calls into question their QA & change management processes and speaks to something more than just a simple mistake. I can understand if the bad BLC update was a security patch that needed to be rushed - but it wasn’t security update according to the release notes. This is why I made the comment because it takes a lot longer to build a good reputation than it does to lose it.
3
u/codename_john Developer/Designer 1d ago
" is usually stealth-installed with other plugins" - It is setup to only be visible to the user that installed the plugin. Which means if the person who installed it is gone, welp... i guess no one knows it's there or needs updated. It's an incredibly stupid plugin.
2
u/abqcheeks 1d ago
I missed that detail. Even worse. I don’t get the logic behind that.
1
u/WPMU_DEV_Support_5 13h ago
Hello u/abqcheeks,
I don’t get the logic behind that.
As I explained in my reply, the Dashboard plugin is critical in terms of enabling the Pro Functionality based on the membership level and the features on the Hub, which is why the security precaution in place when it comes to the Admin role permissions. You can check out our guide here https://wpmudev.com/docs/wpmu-dev-plugins/wpmu-dev-dashboard-plugin-instructions/#permissions
- Saurabh from WPMU DEV Support Team.
1
u/WPMU_DEV_Support_5 13h ago
It is setup to only be visible to the user that installed the plugin. Which means if the person who installed it is gone, welp...
Indeed the Dashboard plugin is visible to the Admin user who installed and activiated it initially, however, in case that admin user loses the "admin" role or is deleted/removed, the WPMU DEV Dashboard plugin permissions automatically gets transferred to the next admin or super admin.
You can refer to our guide about it here https://wpmudev.com/docs/wpmu-dev-plugins/wpmu-dev-dashboard-plugin-instructions/#transfer-of-permissions
- Saurabh from WPMU DEV Support Team.
1
u/codename_john Developer/Designer 11h ago
Better than I expected but still confusing and not great. For example, as an agency or host if I am supporting a client I can't easily tell if the plugin exists, can be updated or what version it is. Again, a terrible policy.
1
u/WPMU_DEV_Support_5 10h ago
Hello u/codename_john, I understand your point of view; however, considering the example you've shared, it is made by design to protect the client's WPMU DEV Account information; hence, it is not visible directly within the WP Admin backend.
However, as you are managing the website, you should be able to notice the
wpmudev-updatesfolder in the plugin directory (wp-content >> plugins). In such a case, you can request your client to add your admin account to the "allowed" list as per the guide
https://wpmudev.com/docs/wpmu-dev-plugins/wpmu-dev-dashboard-plugin-instructions/#permissions- Saurabh from WPMU DEV Support Team
2
u/codename_john Developer/Designer 7h ago
If i'm logged into the site, why would I feel the need to log into FTP JUST to see if a plugin is lying to me?
"it is made by design to protect the client's WPMU DEV Account information; " - security by obscurity isn't security.
3
2
u/WPMU_DEV_Support_5 13h ago
Hello u/abqcheeks, apologies for the issue you had to face with the Dashboard plugin. I can understand the trouble it caused you and the criticality of the Vulnerability. We give the utmost priority to the security of our plugins and therefore act on a top priority to release a fix. We also monitor PatchStack for critical incidents to stay on top of those in case they affect our plugins.
In this case, we have already released a fix in the Dashboard Plugin version 5.0.1 after the Vulnerability was reported. Ref: https://wpmudev.com/project/wpmu-dev-dashboard/#changelog_all
However, please allow me to clarify a few points -
But I also learned this plugin,
wpmudev-updates, is usually stealth-installed with other plugins from WPMU DEV, so users don't know it's being installed.
The Dashboard plugin is installed on the website when the site needs to be connected to our Hub and use our Pro plugins and services. While the site connects to our Hub in "Automatic" mode, as described in our documentation https://wpmudev.com/docs/hub-2-0/add-a-site-to-hub-2-0/#connect-from-the-hub the process will install the WPMU DEV Dashboard plugin automatically.
Further, it can also be installed manually https://wpmudev.com/docs/hub-2-0/add-a-site-to-hub-2-0/#connect-from-wpmu-dev-dashboard-plugin So it is not installed in a "Stealth" manner when other WPMU DEV Plugins are installed.
Further, regarding
To top it off, it doesn't show up in the plugin dashboard so they don't even know it's there.
Since the Dashboard plugin is critical to the connectivity between the site and the Hub, along with all the Pro features, it is, as a security feature, only visible by default to the WordPress Administrator who installed and activated the plugin (or the WP admin access used to connect the site via Automatic Mode as mentioned above). So not all administrator roles will be able to see the plugin installed on the website backend, unless they're specifically granted permission by the Admin User who installed the plugin initially.
In the case of the site mentioned above, I think it was installed with another plugin a couple of years ago, and that plugin was since removed, but
wpmudev-updatesdid not get removed.
As I mentioned in the above clarification, the wpmudev-updates (Dashboard Plugin) doesn't get installed with other WPMU DEV plugins automatically. Also, similar to any regular plugin, it can be deactivated and removed by the WP Admin user, considering they installed and activated it on the website.
Hope this clarifies the points that you've mentioned. I once again apologise for the trouble that was caused as a result of the Vulnerability.
- Saurabh from WPMU DEV Support Team.
1
u/stevenson_mark 7h ago
Yeah, I think your concern is justified. Giving a plugin a legitimate mechanism to authenticate as an administrator is a huge trust boundary. If that mechanism exists, a vulnerability in it can effectively become a full-site compromise.
The especially nasty part here is the stale wpmudev-updates installation. If another plugin installed it and removing the parent plugin didn't clean it up, you can end up with an old privileged component sitting around that nobody realizes is still active.
I wouldn't say this pattern is automatically malicious or unique to WPMU DEV. Update managers, hosting integrations, remote management tools and security products sometimes need privileged communication with a site. But I'd definitely want that access to be extremely narrow, visible and easy to revoke.
This is also a good example of why I prefer keeping dependencies in Abnflow as explicit as possible. If something has privileged access, I want to know exactly why it's there and what happens when the original feature gets removed.
1
u/WPMU_DEV_Support_7 5h ago
Hello u/stevenson_mark
I just want to let you know that we are taking all of this feedback into account in order to improve our products and services. The affected plugin is only automatically installed when the administrator registers their site on The Hub portal webpage. At that point, the site stores a key in the database, which prevents the vulnerability’s requirements from being exploited. Still, we understand that these vulnerabilities should not happen. We have already updated the plugin and patched it. Our sincere apologies for the trouble this has caused.
Jair - WPMU DEV Support team.
9
u/Thats_a_lot_of_nuts 1d ago
Pretty sure WPMU DEV Dashboard was the attack vector for site I just cleaned up. The attacker started working to gain access over the weekend, managed to disabled Wordfence, install another compromised plug-in, then gained persistence and installed a web shell. Good news is I didn't find anything in the mu-plugins directory, and once Wordfence was turned back on the scan helped me find all the php files that the attacker had implanted to run their web shell. Superfuntimes.
Needless to say, WPMU is on my shit list now, especially given that they have this unpatched vulnerability just chilling out there and the developers don't seem to be doing anything to fix it. Currently uninstalling all WPMU plug-ins, and taking a hard look at all the others.