The affected plugin contains an authentication bypass flaw (CWE‑287). When a WordPress site has not yet linked the WPMU DEV Dashboard to a Hub account, the API key used to sign WDP_AUTH requests is empty, allowing an attacker to forge the HMAC header required by the /?wpmudev-hub= endpoint. The plugin’s validate_hash() routine therefore accepts the forged signature and the validate_nonce() check is removed in version 5.0.0, so no replay protection remains. Without any capability check on the remote handler, a unauthenticated user can trigger privileged Hub actions, including installing and activating plugins from arbitrary URLs, deleting plugins or themes, upgrading core WordPress, or logging in as an administrator via SSO, which results in remote code execution and full site compromise.

All WordPress sites that have installed the WPMU DEV Dashboard plugin at version 5.0.0 or earlier and have not connected to the WPMU DEV Hub—i.e., the site’s API key is blank—are vulnerable. Version 5.0.0 additionally removes the nonce check, further broadening the attack surface. Sites that have already linked the plugin to a Hub account and therefore maintain a non‑empty 64‑character API key are not affected.

The CVSS score of 8.1 denotes a high‑severity vulnerability. EPSS data is not available, and the weakness is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request to the public /?wpmudev-hub= endpoint with a crafted WDP_AUTH header that bypasses authentication checks. An attacker needs no special privileges or authentication to exploit this flaw; any unauthenticated user who can reach the affected WordPress site can perform the exploit.