WPMU DEV Dashboard Authentication Bypass (Hub SSO) — Detection, Hunting, and Remediation Guide for WordPress Defenders

---
title: WordPress Plugin or Theme Editor Access via HTTP POST
id: 8f4c2a11-3b7e-4d9a-b2c6-5e1f0a8d3c47
status: experimental
description: Detects HTTP POST requests to the WordPress plugin or theme editor, a common post-exploitation step after authentication bypass to achieve remote code execution. Legitimate use is rare in production environments.
references:
  - https://www.wordfence.com/blog/2026/08/wordfence-argus-finds-critical-authentication-bypass-in-wpmu-dev-dashboard-plugin/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/20
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/wp-admin/plugin-editor.php'
      - '/wp-admin/theme-editor.php'
      - '/wp-admin/update.php'
  condition: selection
falsepositives:
  - Legitimate administrator code edits (should be near-zero in production; editors are commonly disabled via DISALLOW_FILE_EDIT)
level: high
---
title: PHP File Created in WordPress Uploads Directory
id: 2d7e9b34-6c1a-4f8e-a3d9-7b5c2e0f4a61
status: experimental
description: Detects creation of PHP files under wp-content/uploads, a strong indicator of webshell deployment following WordPress admin compromise. The uploads directory should never contain executable PHP.
references:
  - https://www.wordfence.com/blog/2026/08/wordfence-argus-finds-critical-authentication-bypass-in-wpmu-dev-dashboard-plugin/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/20
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: '/wp-content/uploads/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
  condition: selection
falsepositives:
  - Rare misconfigured plugins that write PHP into uploads (investigate any hit regardless)
level: critical
---
title: Web Server Process Spawning Shell or System Utility
id: 4a1c8f62-9d3b-4e7a-b5f1-2c8d6a0e3b95
status: experimental
description: Detects web server worker processes (apache2, nginx, php-fpm, httpd) spawning command shells or system utilities, indicative of webshell-driven command execution after a WordPress compromise.
references:
  - https://www.wordfence.com/blog/2026/08/wordfence-argus-finds-critical-authentication-bypass-in-wpmu-dev-dashboard-plugin/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/08/20
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - 'php-fpm: pool www'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Backup or maintenance plugins invoking system utilities; validate against change windows and plugin inventory
level: high

// Hunt: WPMU DEV Dashboard auth bypass attack chain — unauthenticated admin activity and post-exploitation
// Run against web logs ingested into Sentinel (IIS/Apache/Nginx via CommonSecurityLog or custom W3C tables).
// Part 1: Admin sessions with no corresponding wp-login.php authentication from the same source IP
let lookback = 14d;
let logins = CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where RequestURL has "/wp-login.php" and RequestMethod == "POST"
| summarize LoginCount=count() by SourceIP;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where RequestURL has_any ("/wp-admin/plugin-editor.php", "/wp-admin/theme-editor.php", "/wp-admin/update.php")
    or (RequestURL has "/wp-admin/admin-ajax.php" and RequestMethod == "POST")
| join kind=leftanti logins on SourceIP
| project TimeGenerated, SourceIP, RequestMethod, RequestURL, RequestContext, DeviceName
| order by TimeGenerated desc;
// Part 2: If web servers are onboarded to Defender for Endpoint — webshell child processes
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName has_any ("apache2", "httpd", "nginx", "php-fpm")
| where FileName has_any ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python3", "perl")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

-- Hunt for webshell indicators on WordPress web servers following WPMU DEV Dashboard compromise
-- Artifact 1: PHP files in the uploads tree modified within the last 30 days (should return zero rows)
LET uploads_php = SELECT FullPath, Mtime, Size
FROM glob(globs='/var/www/**/wp-content/uploads/**/*.php')
WHERE Mtime > now() - 2592000

SELECT FullPath, Mtime, Size FROM uploads_php

-- Artifact 2: Established network connections from web server processes (unexpected egress)
SELECT Pid, Name, Path, Status, "Laddr.IP" AS LocalIP, "Laddr.Port" AS LocalPort,
       "Raddr.IP" AS RemoteIP, "Raddr.Port" AS RemotePort
FROM netstat()
WHERE Name =~ 'apache2|httpd|nginx|php-fpm'
  AND Status = 'ESTABLISHED'
  AND NOT "Raddr.IP" =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|127\.)'

-- Artifact 3: Recently modified plugin/theme PHP files (post-exploitation edits via wp-admin editor)
SELECT FullPath, Mtime, Size
FROM glob(globs='/var/www/**/wp-content/{plugins,themes}/**/*.php')
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

#!/bin/bash
# WPMU DEV Dashboard auth bypass — emergency remediation & verification script
# Run on each WordPress host. Requires WP-CLI and appropriate permissions.
set -euo pipefail

WP_PATH="${1:-/var/www/html}"
echo "[*] Targeting WordPress at: $WP_PATH"

# 1. Check if WPMU DEV Dashboard is installed and report version
if wp plugin is-installed wpmudev-updates --path="$WP_PATH" --allow-root 2>/dev/null; then
  echo "[!] WPMU DEV Dashboard detected."
  wp plugin get wpmudev-updates --path="$WP_PATH" --allow-root --format=table
  # 2. Update immediately to the latest (patched) release
  echo "[*] Updating WPMU DEV Dashboard to latest release..."
  wp plugin update wpmudev-updates --path="$WP_PATH" --allow-root
  echo "[+] Updated. Verify the version against the patched version in the Wordfence advisory."
else
  echo "[+] WPMU DEV Dashboard not installed on this site."
fi

# 3. Harden: disable plugin/theme editors if not already disabled
if ! grep -q "DISALLOW_FILE_EDIT" "$WP_PATH/wp-config.php"; then
  echo "define('DISALLOW_FILE_EDIT', true);" >> "$WP_PATH/wp-config.php"
  echo "[+] Set DISALLOW_FILE_EDIT=true in wp-config.php (blocks editor-based code write primitive)."
else
  echo "[+] DISALLOW_FILE_EDIT already present — verify it is set to true."
fi

# 4. Audit: list all administrator accounts — look for unknown users
wp user list --role=administrator --path="$WP_PATH" --allow-root --format=table

# 5. Audit: hunt for PHP files in uploads (should return nothing)
echo "[*] Scanning uploads tree for PHP payloads..."
find "$WP_PATH/wp-content/uploads" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.php[57]' \) -print || true

echo "[+] Done. Review output, then check wp-admin users, cron entries, and mu-plugins for persistence."