A critical (CVSS 9.8) authentication bypass in the WPMU DEV Dashboard WordPress plugin lets unauthenticated attackers forge a valid Hub SSO handshake and land an administrator session on affected sites.
What Is It
CVE-2026-76581 is an improper verification of cryptographic signature flaw (CWE-347) in the WPMU DEV Dashboard plugin for WordPress, in all versions up to and including 5.0.1.
According to the Wordfence advisory, the bug lives in the plugin's Hub SSO handshake, split across two unauthenticated AJAX actions. As described there, the wdpsso_step1 action signs and discloses an HMAC over an unseparated concatenation of the token, state, redirect, and domain values, while the wdpsso_step2 action verifies an unseparated concatenation that omits the domain field entirely. Because neither side is described as using field separators, the two messages are ambiguous: the advisory indicates an attacker can obtain a legitimate HMAC from step 1, then shift the domain value into the redirect field and replay the same signature to step 2. On that account the signature still validates and the handshake completes, yielding an authenticated administrator session. This chain reflects the published advisory description rather than independently reproduced exploitation.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability. That is the worst-case profile for a WordPress plugin flaw: anyone who can reach the site's AJAX endpoint can attempt it, and a successful attempt is full administrative control of the site, not a partial disclosure.
As described, the exploitation primitive is also cheap. It would require no cryptographic attack on the HMAC itself, only rearranging attacker-controlled fields between two requests.
What's Vulnerable
- Vendor: wpmudev
- Product: WPMU DEV Dashboard (WordPress plugin)
- Affected versions: all versions
<= 5.0.1
Per the advisory, exploitation requires the site to be connected to WPMU DEV with Hub SSO enabled and mapped to an administrator account. Sites not connected to the Hub, or without SSO enabled, are outside the described attack path.
Patch Status
The NVD record is in Received status as of its 2026-08-28 publication and lists no fixed version, no patch reference, and no vendor remediation guidance. There is no CISA KEV entry for this CVE in the Known Exploited Vulnerabilities catalog (linked below), so active exploitation is not confirmed by KEV at this time. Administrators of Hub-connected sites should treat disabling Hub SSO as the available mitigation until a patched release is confirmed via the vendor.
Sources
- NVD, CVE-2026-76581: https://nvd.nist.gov/vuln/detail/CVE-2026-76581
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4321c8-15a4-46f5-9b0e-2098a7fcfb5b?source=cve
- WPMU DEV, WPMU DEV Dashboard project page: https://wpmudev.com/project/wpmu-dev-dashboard/
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog