I spent some time this weekend finding the entrance vector for a site that was getting re-hacked after cleanup. I mean I knew it would get re-hacked since I wasn't finding the the vector in the usual "easy" ways. Turns out it was this: nvd.nist.gov/vuln/detail/CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable

It's bad enough this plugin adds an alternate auth path to your web site, with full admin control given to some 3rd party you don't know. But I also learned this plugin, wpmudev-updates, is usually stealth-installed with other plugins from WPMU DEV, so users don't know it's being installed. To top it off, it doesn't show up in the plugin dashboard so they don't even know it's there.

In the case of the site mentioned above, I think it was installed with another plugin a couple of years ago, and that plugin was since removed, but wpmudev-updates did not get removed.

Is it just me or is it a little crazy to allow plugins to provide auth bypass for complete admin control of your site by third parties? Is this a common pattern? What other plugins do this aside from the WPMU DEV ones? (I'm talking about the situation where there ISN'T an active exploit in the code ... the intended use scenario is what seems insane to me).