CVE-2026-75957
Received Received - Intake

Authentication Bypass in Ultimate Multisite WordPress Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Wordfence

Description
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_customer_after_checkout` function. This is due to the publicly accessible `wu_ajax_nopriv_wu_validate_form` AJAX handler accepting a freely obtainable checkout nonce, and the `checkout_form=wu-finish-checkout` parameter causing `get_validation_rules()` to discard all validation rules while `finish_checkout_form_fields()` returns an empty step list — forcing `is_last_step()` to return true and routing the request directly into full order processing — after which `maybe_create_customer()` resolves the attacker-supplied `email_address` to an existing WordPress user ID without any authentication or ownership verification, and `login_customer_after_checkout()` calls `wp_set_auth_cookie()` for that user ID via a passwordless code path. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including a Network Super Admin — simply by knowing their email address. Exploitation requires that the targeted user account has no pre-existing Ultimate Multisite customer record; accounts such as a Network Super Admin on a fresh Multisite install, or any administrator or editor added before Ultimate Multisite was configured, satisfy this condition and are therefore exploitable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-75957
EUVD
EUVD-2026-90546

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ultimate_multisite ultimate_multisite to 2.15.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthenticated attackers to bypass authentication in the Ultimate Multisite WordPress plugin by manipulating the checkout_form parameter. It exploits a flaw in the wu_ajax_nopriv_wu_validate_form AJAX handler, which accepts a checkout nonce and processes requests without proper validation. Attackers can log in as any existing WordPress user, including Network Super Admins, by knowing their email address.

Detection Guidance

This vulnerability can be detected by checking for unauthorized login attempts or successful logins as privileged users without authentication. Monitor WordPress logs for AJAX calls to wu_ajax_nopriv_wu_validate_form with the checkout_form=wu-finish-checkout parameter. Review user sessions for unexpected logins, especially for Network Super Admins or users without prior Ultimate Multisite records.

Impact Analysis

If you use the Ultimate Multisite plugin, attackers could gain unauthorized access to your WordPress admin panel, steal sensitive data, or take control of your site. This includes accessing user accounts, modifying content, or installing malicious plugins. The impact is severe as it affects all user roles, including administrators.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Immediately update the Ultimate Multisite plugin to the latest version beyond 2.15.0. If an update is not available, disable the plugin until a patch is released. Review all user accounts for unauthorized access and enforce password resets for potentially affected accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart