Critical Authentication Bypass in WPMU DEV Dashboard Plugin Exposes WordPress Sites
A critical authentication bypass vulnerability (CVE-2026-76581) in the WPMU DEV Dashboard WordPress plugin, affecting versions up to 5.0.1, allows unauthenticated attackers to gain administrator access when Hub Single-Sign On is enabled.
Wordfence researchers have identified a critical authentication bypass vulnerability in the WPMU DEV Dashboard WordPress plugin, a widely used tool with an estimated 350,000 active installations. The flaw, tracked as CVE-2026-76581, affects all versions of the plugin up to and including 5.0.1. When the Hub Single-Sign On (SSO) feature is enabled, unauthenticated attackers can exploit this vulnerability to gain administrator privileges, potentially leading to a complete website takeover and, in some configurations, remote code execution.
The vulnerability arises from an inconsistent and ambiguous construction of HMAC (Hash-based Message Authentication Code) messages within the SSO flow. Specifically, the wdpsso_step1 AJAX action signs a concatenation of the token, state, redirect, and domain values. However, the subsequent wdpsso_step2 action, which verifies the signature, omits the domain field from its message construction. This discrepancy allows an attacker to intercept the signed message from step 1, manipulate it by moving the domain value into the redirect field, and then replay it to step 2, tricking the plugin into granting an authenticated administrator session.
Wordfence disclosed the vulnerability to the WPMU DEV team on August 19, 2026. The developer responded promptly, acknowledging the report and submitting a pre-release patch for review just two days later. This patch was publicly released as version 5.0.2 on August 24, 2026. Wordfence commended the WPMU DEV team for their swift action in addressing the critical security flaw.
To protect its users, Wordfence deployed a firewall rule to block exploitation attempts on August 25, 2026, for its Premium, Care, and Response customers. Free users will receive the same protection 30 days later, on September 24, 2026. The company noted that the firewall rule was deployed shortly after the patch release because it is a feature-breaking rule that could potentially disrupt legitimate SSO functionality if applied without the corresponding plugin update.
Users of the WPMU DEV Dashboard plugin are strongly urged to update to the patched version 5.0.2 immediately. For sites that cannot update right away, disabling the Hub SSO feature until the update can be applied is recommended as a temporary mitigation measure. The vulnerability carries a CVSS rating of 9.8, classifying it as critical.
The WPMU DEV Dashboard plugin is designed to connect WordPress sites to WPMU DEV services and facilitates a Hub SSO flow, enabling authorized Hub users to log into connected WordPress sites. The SSO process involves two AJAX actions, wdpsso_step1 and wdpsso_step2, both of which are accessible to unauthenticated visitors as part of the initial login exchange. This necessary exposure requires robust security measures to differentiate legitimate messages from malicious inputs.
Technical analysis revealed that both wdpsso_step1 and wdpsso_step2 are included in the $nopriv_actions array within the WPMUDEV_Dashboard_Ajax class, making them reachable by unauthenticated users. The authenticate_sso_access_step1() function generates a token and state, then constructs an HMAC-SHA256 signature using a delimited concatenation of these values along with the redirect and site domain. This signature, along with other parameters, is sent to the WPMU DEV Hub SSO endpoint.
Subsequently, the authenticate_sso_access_step2() function receives a signature from the Hub and independently reconstructs the expected signed message. The critical flaw lies in this reconstruction, where only the token, state, and redirect are concatenated, omitting the domain. This omission creates the window for attackers to forge a valid signature by manipulating the parameters passed in the wdpsso_step1 call, ultimately leading to unauthorized administrative access.