CVE-2026-76581: WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WPMU DEV Dashboardto a version that resolves this vulnerability.Fixed in 5.0.1Patch WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites running WPMU DEV Dashboard version 5.0.1 or earlier are exposed when they are connected to WPMU DEV, have Hub SSO enabled, and have that SSO mapped to an administrator account.
What access does an attacker need?
No authentication, privileges, or user interaction are required. An attacker can use the unauthenticated SSO AJAX actions to obtain an HMAC and replay it with manipulated fields.
What is the resulting impact if exploitation succeeds?
Successful exploitation results in an authenticated WordPress administrator session. This gives the attacker administrator-level access to the affected site.
Is a default installation necessarily affected?
No. Exploitation depends on Hub SSO being enabled and mapped to an administrator, in addition to the site using an affected plugin version and being connected to WPMU DEV.