Vulnerability · Published Aug 12, 2026 · Assigned by WPScan
CVE-2026-16051WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action
Critical 9.8
In plain English
A critical-severity code injection in wpmudev-updates from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 41.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | wpmudev-updates | 0 – before 5.0.1 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/8dae5fbf-2e9d-4978-b97d-a20e076cd309/ exploit, vdb-entry, technical-description