CVE-2026-76581

CVE-2026-76581 is a critical authentication bypass (CWE-347) in the WPMU DEV Dashboard plugin for WordPress, affecting all versions up to and including 5.0.1, caused by inconsistent HMAC message construction between the unauthenticated wdpsso_step1 and wdpsso_step2 AJAX actions: step 1 signs an unseparated concatenation of token, state, redirect, and domain, while step 2 verifies a concatenation that omits the domain field. An unauthenticated attacker can obtain a valid HMAC from step 1, move the domain value into the redirect field, and replay the signature to step 2, which accepts it and returns an authenticated administrator session. Only sites connected to WPMU DEV with Hub single sign-on (SSO) enabled and mapped to an administrator account are exploitable, and a successful attack grants full admin access, typically enabling complete site takeover. No exploitation has been reported: the flaw is not in CISA KEV, EPSS estimates a 0.3% probability of exploitation within 30 days, and no public proof-of-concept is known.

What to do: Update the WPMU DEV Dashboard plugin to a patched release newer than 5.0.1 as soon as one is available. Until patched, disable Hub SSO (or ensure it is not mapped to an administrator account) to eliminate the bypass path, and review web logs for unauthenticated admin-ajax.php requests invoking the wdpsso_step1/wdpsso_step2 actions.