A critical authentication bypass vulnerability has been identified in the WPMU DEV Dashboard WordPress plugin, which could allow unauthenticated attackers to gain administrator-level access to vulnerable sites configured with Hub Single Sign-On (SSO).
This vulnerability, tracked as CVE-2026-76581, has a CVSS score of 9.8 and affects WPMU DEV Dashboard versions 5.0.1 and earlier. The plugin has approximately 350,000 active installations. WPMU DEV released version 5.0.2 on August 24, 2026, to address this issue.
Critical WordPress Plugin Flaw
The vulnerability was discovered on August 19 by Wordfence researcher Alex Thomas, with assistance from Wordfence Argus, the company’s AI-powered vulnerability research system.
The problem arises from an inconsistency in how the plugin constructs and validates HMAC-SHA-256 signatures during the Hub SSO authentication process.
The WPMU DEV Dashboard utilizes two unauthenticated AJAX actions, wdpsso_step1 and wdpsso_step2, to initiate and complete SSO authentication.
These endpoints must be accessible before a user logs into WordPress. However, the implementation allows an attacker to exploit ambiguity in the signed data.
In the first SSO stage, the plugin creates an HMAC over a concatenation of four values: token, hashed state, redirect URL, and site domain.
These values are concatenated without delimiters or length prefixes, and the HMAC along with the related non-secret values is returned as part of the SSO exchange.
During the second stage, the plugin verifies an HMAC constructed from only three values: token, state, and redirect, omitting the domain entirely and using an unseparated concatenation. This discrepancy creates a canonicalization confusion condition.
An attacker can initiate the first step with an empty redirect parameter. The resulting signature covers a byte sequence effectively structured as token || state || domain.
The attacker can then submit the same signature to the second endpoint, setting the domain value in the redirect field. Since the second endpoint calculates its verification HMAC over token || state || redirect, it reconstructs the same byte sequence and accepts the signature.
The attack does not require disclosure of the site’s WPMU DEV API key. Instead, the unauthenticated first-stage endpoint functions as a signing oracle, producing a valid HMAC that can be replayed in a different logical context.
Additional anti-replay controls do not prevent the attack because the attacker receives a fresh token, the associated hashed state, and the required pre-SSO cookie during the first stage.
Once validation succeeds, the plugin invokes WordPress authentication functions to create a session for the account mapped to Hub SSO.
If that mapped account belongs to an administrator, the attacker can gain full control over the WordPress installation.
Depending on the enabled administrative capabilities, this may lead to plugin installation, theme modification, credential theft, data access, or remote code execution via WordPress’s built-in code editing mechanisms.
This flaw is different from a previous issue affecting WPMU DEV Dashboard versions up to 5.0.0, which involved empty-key WDP-AUTH validation. The newly disclosed vulnerability remains exploitable in version 5.0.1 and specifically targets sites connected with Hub SSO enabled.
The 5.0.2 patch stores the HMAC generated during step one on the server side and rejects it if it is replayed as the incoming signature during step two. Testing has confirmed that the patched version blocks the replay attack without issuing a wordpress_logged_in cookie.
Administrators should immediately update WPMU DEV Dashboard to version 5.0.2 or later. Organizations that are unable to patch immediately should disable Hub SSO until the update is installed.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
.){kind=link}