CVE-2026-16051CWE-94code-injection

CVE-2026-16051

Critical · published August 12, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00860 · 58.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-12T10:18Z
References (1)
https://wpscan.com/vulnerability/8dae5fbf-2e9d-4978-b97d-a20e076cd309/ · [email protected]
EPSS history
Timeline
  • 12 AUG 06:00Z
    WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action
    cvelistv5