External risk intelligence

wpmudev-updates Plugin Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16051

This vulnerability affects a WordPress plugin, which is a component of a web application. WordPress sites are frequently deployed as public-facing web services, making the management interfaces and plugins of these sites commonly reachable over the public internet.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a widely used WordPress plugin that could allow unauthorized code execution. This issue stems from an incomplete validation of update packages and a lack of protection against replay attacks, potentially enabling attackers to compromise systems remotely.

Unsecured plugin updates allow remote code execution.
Protects against attackers taking control of systems.
Confirm if this plugin is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by crafting and replaying a signed management request, which is then used by the vulnerable plugin to install and execute arbitrary code. This could lead to an attacker taking full control of the affected website.

Attacker needs a valid signed request.
Attacker replays management request.
Attacker achieves remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to install and execute arbitrary code on a vulnerable system by replaying or obtaining a valid signed management request. This could lead to a compromise of the affected WordPress site and its underlying server.

System code and data.
Replay or obtain signed management request.
Remote code execution and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this vulnerability likely falls to web application or platform teams responsible for managing WordPress deployments, in coordination with security teams for exposure assessment. The first practical step is to identify all WordPress instances utilizing the affected plugin, determine their internet reachability and business criticality, and confirm the accountable owner before planning remediation.

Application or platform teams own remediation.
Verify plugin presence and remote interface exposure.
Plan updates during planned maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the wpmudev-updates plugin?

This WordPress plugin is a management tool designed to help administrators oversee, update, and maintain multiple site installations from a central dashboard. It functions by automating software delivery and configuration tasks, which necessitates a remote management interface to communicate with managed websites and process update packages.

What is the weakness in CVE-2026-16051?

The vulnerability is categorized as CWE-94, or Improper Control of Generation of Code. In plain English, the plugin fails to properly verify that incoming update packages are authentic or intended for the current session. Because it lacks replay protection, it mistakenly accepts old, validly signed commands as legitimate, allowing an attacker to inject and execute their own unauthorized code.

How does an attacker trigger this vulnerability?

An attacker triggers this by capturing and replaying a valid signed management request sent to the plugin's interface. If the attacker cannot obtain or replay such a signed request, the attack will not succeed. The issue is specifically tied to how the plugin processes these authenticated requests, rather than general site traffic.

Is my site at risk if it uses this plugin?

According to Halo Surface Signal, this plugin is frequently used on public-facing web services, which makes the management interface reachable over the internet. If your WordPress site is exposed to the public internet, it faces a higher likelihood of being reachable for this type of attack compared to a site restricted to an internal network.

Do I need to update my WordPress plugins immediately?

Your first step is to confirm whether you have the vulnerable version of the plugin installed on your systems. Once confirmed, coordinate with your technical team to inventory these instances, assess their internet reachability, and schedule the update to version 5.0.1 or higher during your next maintenance window.

References

wpscan.com/vulnerability/8dae5fbf-2e9d-4978-b97d-a20e076cd309/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.