Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.
During internal research on August 19, 2026, Wordfence discovered an authentication bypass in the WPMU DEV Dashboard WordPress plugin, which has roughly 350,000 active installations. Unauthenticated attackers can gain administrator access when Hub Single-Sign On is enabled, enabling complete site takeover. If an administrator-writable code mechanism such as the plugin or theme editor is available, the flaw can lead to remote code execution.
- Unauthenticated attackers gain admin access when Hub Single-Sign On is enabled.
- Flaw can escalate to RCE via the WordPress plugin or theme editor.
- Plugin has an estimated 350,000 active installations.
- Found August 19, 2026 by Wordfence during internal research.
- Products
- WPMU DEV Dashboard
From the original article
On August 19th, 2026, during internal research, I discovered an Authentication Bypass vulnerability in WPMU DEV Dashboard, a WordPress plugin with an estimated 350,000 active installations. This vulnerability makes it possible for unauthenticated attackers to gain administrator access when Hub Single-Sign On is enabled.
By Alex Thomas · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.