CVE-2026-103646: Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ultimate Multisite WordPress pluginto a version that resolves this vulnerability.Fixed in 2.17.0
Event History
Frequently Asked Questions
Which deployments are actually exposed to account takeover?
Deployments running Ultimate Multisite before 2.17.0 are exposed only where a logged-out checkout form is configured without a password field, causing passwords to be auto-generated. The target WordPress account must also not already have an Ultimate Multisite customer record.
What does an attacker need to exploit this issue?
An attacker needs network access to the vulnerable checkout flow and knowledge of the target user's email address. No authentication or user interaction is required, and the target can be a Network Super Admin.
Does the earlier 2.15.1 fix address this vulnerability?
No. The issue remains exploitable through versions up to and including 2.16.1, despite 2.15.1 being expected to cover the earlier CVE-2026-75957 fix.
What can be changed if upgrading is not immediately possible?
Configure checkout forms to require a password field rather than using auto-generated passwords. This removes the checkout configuration required for exploitation.