CVE-2026-76581
Deferred Deferred - Pending Action

Authentication Bypass in WPMU DEV Dashboard Plugin

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Wordfence

Description
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-76581
EUVD
EUVD-2026-67464

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpmu_dev wpmu_dev_dashboard to 5.0.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WPMU DEV Dashboard plugin for WordPress has an authentication bypass flaw in versions up to 5.0.1. It involves inconsistent HMAC message construction between two AJAX actions, wdpsso_step1 and wdpsso_step2. Step 1 signs a concatenated string of token, state, redirect, and domain values, while step 2 verifies a similar string missing the domain field. Attackers can exploit this by moving the domain value into the redirect field to bypass authentication and gain an admin session.

Detection Guidance

Detecting this vulnerability requires checking if the WPMU DEV Dashboard plugin version is up to 5.0.1 or older. Inspect WordPress installations for the plugin and verify its version. No specific commands are provided in the context to actively detect exploitation attempts.

Impact Analysis

If you use the WPMU DEV Dashboard plugin with Hub SSO enabled and mapped to an administrator account, an unauthenticated attacker could exploit this flaw to gain full administrative access to your WordPress site. This could lead to site takeover, data theft, malware installation, or defacement.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. A successful exploit may result in data breaches, triggering compliance violations, legal penalties, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Immediately update the WPMU DEV Dashboard plugin to the latest version beyond 5.0.1. Disable Hub SSO if not required or restrict administrator mappings. Monitor for unauthorized administrator sessions or suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart