Unauthenticated Admin Authentication Bypass in WPMU DEV Dashboard 5.0.1 and earlier
AI analysis
CVE-2026-76581 is a critical authentication bypass (CWE-347) in the WPMU DEV Dashboard plugin for WordPress, affecting all versions up to and including 5.0.1, caused by inconsistent HMAC message construction between the unauthenticated wdpsso_step1 and wdpsso_step2 AJAX actions: step 1 signs an unseparated concatenation of token, state, redirect, and domain, while step 2 verifies a concatenation that omits the domain field. An unauthenticated attacker can obtain a valid HMAC from step 1, move the domain value into the redirect field, and replay the signature to step 2, which accepts it and returns an authenticated administrator session. Only sites connected to WPMU DEV with Hub single sign-on (SSO) enabled and mapped to an administrator account are exploitable, and a successful attack grants full admin access, typically enabling complete site takeover. No exploitation has been reported: the flaw is not in CISA KEV, EPSS estimates a 0.3% probability of exploitation within 30 days, and no public proof-of-concept is known.
What to do: Update the WPMU DEV Dashboard plugin to a patched release newer than 5.0.1 as soon as one is available. Until patched, disable Hub SSO (or ensure it is not mapped to an administrator account) to eliminate the bypass path, and review web logs for unauthenticated admin-ajax.php requests invoking the wdpsso_step1/wdpsso_step2 actions.
Affected
| WPMU DEV Dashboard (WordPress plugin) | All versions up to and including 5.0.1 |
Estimated exposure
large≈100,000+ plugin installs; exploitable subset (Hub SSO enabled and mapped to an admin) likely in the tens of thousands — The WPMU DEV Dashboard connector plugin shows on the order of 100,000 active installs in public WordPress.org statistics, but the flaw is only triggerable on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator,…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.