CVE-2026-15413 is a WordPress plugin backdoor disguised as a 'sentence publisher' that exposes an authenticated REST API protected by Ed25519 signatures. The CVSS 10 is technically accurate but obscures a more troubling reality: this is supply chain compromise using security best practices as camouflage, and our detection infrastructure has no framework for distinguishing the two.
The attacker selected Ed25519 not for its cryptographic properties but because properly-signed API calls are indistinguishable from legitimate integrations in our heuristic models. The health check endpoint compounds this — it presents a normal-appearing response to passive scanning while the actual payload sits behind cryptographic authentication. Your detection tooling looks for malformed requests, predictable tokens, and SQL injection patterns. It does not look for correctly-signed API calls authenticated against an operator key because that pattern describes valid security architecture.
What should you actually do? First, delete the plugin — but understand this does not close the exposure. The attacker's Ed25519 public key is embedded in every codebase that installed the plugin, and it persists after removal in filesystem remnants, database entries, backup snapshots, and staging environments that never get cleaned. This is not a vulnerability waiting to be patched; it is a permanent artifact of exposure. Second, examine your WordPress installations for plugins whose functionality doesn't match their description — the social engineering (a 'sentence publisher' exposing a full API with no visible sentence-publishing feature) is the most reliable detection signal, not the cryptography. Third, accept that behavioral analysis frameworks will fail against this class of threat. Supply chain security that relies on detecting 'suspicious patterns' cannot distinguish between a security-conscious developer and a sophisticated operator using the same patterns correctly.
The uncomfortable question this CVE raises: when legitimate security implementation becomes indistinguishable from threat indicators, does the security community's heuristic model finally need retirement?