by Kastro
Paper/Archive/CVE-2026-16051

CVE-2026-16051

Unknown wpmudev-updates — WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action

EPSS 0.9%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 58.5.585 × 2011.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).

Affected

ProductAffectedFixed inSource
wpmudev-updates< 5.0.15.0.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/8dae5fbf-2e9d-4978-b97d-a20e076cd309