CVE-2026-76581 is a critical (CVSS 9.8) unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, used on an estimated 350,000 WordPress sites. It lets an attacker forge a fully authenticated administrator session with no login credentials at all — and it’s notably the second unauthenticated admin bypass disclosed in this same plugin within the same month, which is worth sitting with for a moment if you’re evaluating how much trust to place in this specific plugin going forward.
How the Exploit Actually Works
The flaw lives in the plugin’s Hub Single Sign-On implementation, specifically in two unauthenticated AJAX actions: wdpsso_step1 and wdpsso_step2. Step 1 signs and discloses an unseparated concatenation of token, state, redirect, and domain values. Step 2 verifies a similarly unseparated concatenation — but one that omits the domain field entirely. That mismatch is the whole vulnerability: an attacker can take a valid HMAC signature obtained from step 1, move the domain value into the redirect field, and replay it against step 2 to produce a session step 2 accepts as a legitimately signed, valid administrator login.
Who’s Actually at Risk
Exploitation requires three specific conditions to line up: the site is connected to WPMU DEV, Hub Single Sign-On is enabled, and the Hub SSO account is mapped to a WordPress administrator. Sites not using Hub SSO at all aren’t exposed to this specific exploit chain — but given this is the plugin’s second unauthenticated admin bypass in one month, sites using any of the plugin’s authentication-adjacent features are worth treating with extra scrutiny regardless of whether this exact flaw applies.
Who’s Affected
| Version | Status |
|---|---|
| 5.0.1 and earlier | Vulnerable — update immediately if Hub SSO is enabled |
| 5.0.2 or later | Patched |
What to Do Right Now
- Update WPMU DEV Dashboard to 5.0.2 or later immediately.
- Check whether Hub SSO is actually enabled and mapped to an administrator on your site — if so, treat this as higher priority given the exploit chain applies directly.
- Review admin accounts for anything unfamiliar, particularly any created or modified since this vulnerability’s window — a successful bypass grants full administrator access, which an attacker could use to create a persistent backdoor account.
- Given the pattern of repeated auth-bypass disclosures in this plugin this month, consider whether Hub SSO is actually necessary for your workflow, or whether disabling it reduces your attack surface without meaningful cost.
If you find signs of a completed compromise, see WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. Want a site checked directly? Get in touch.
Frequently Asked Questions
Am I affected if I don’t use Hub SSO?
The specific exploit chain requires Hub SSO to be enabled and mapped to an administrator account, so sites without it active aren’t directly exposed to this particular vulnerability — but updating is still recommended given the plugin’s broader pattern this month.
Why does this keep happening with the same plugin?
This is publicly documented as the plugin’s second unauthenticated admin bypass disclosed within a single month — which is unusual and worth factoring into how much you rely on this specific plugin’s authentication features going forward, independent of whether you’ve patched this specific CVE.
Does updating alone undo damage from an already-exploited bypass?
No. Updating closes the vulnerability going forward, but a successfully forged admin session could already have been used to create a persistent backdoor before you patched — audit your admin accounts regardless of update timing.
Featured image: original illustration.