CVE-2026-76581 Overview
The WPMU DEV Dashboard plugin for WordPress contains an authentication bypass vulnerability affecting all versions up to and including 5.0.1. The flaw resides in the Hub Single Sign-On (SSO) flow, where the wdpsso_step1 and wdpsso_step2 unauthenticated AJAX actions construct HMAC messages inconsistently. Step 1 signs a concatenation of token, state, redirect, and domain values, while step 2 verifies a concatenation that omits the domain field. Unauthenticated attackers can obtain a valid HMAC from step 1 and replay it to step 2 by shifting the domain value into the redirect field. Successful exploitation grants an authenticated administrator session on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator.
Critical Impact
Remote, unauthenticated attackers can obtain administrator-level access to affected WordPress sites without credentials or user interaction.
Affected Products
- WPMU DEV Dashboard plugin for WordPress, all versions through 5.0.1
- WordPress sites connected to WPMU DEV with Hub SSO enabled
- Sites where Hub SSO is mapped to an administrator account
Discovery Timeline
- 2026-08-28 - CVE-2026-76581 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-76581
Vulnerability Analysis
This vulnerability is classified as an Authentication Bypass caused by Improper Verification of Cryptographic Signature [CWE-347]. The plugin exposes two unauthenticated AJAX endpoints, wdpsso_step1 and wdpsso_step2, that together implement the Hub SSO handshake. The signing side and the verifying side of that handshake disagree on the shape of the message being authenticated.
Step 1 accepts input from the caller, then generates and returns an HMAC computed over a concatenated string that includes the domain value. Step 2 recomputes the HMAC over a similar concatenation, but the domain field is not part of that verification input. Because the fields are concatenated without a delimiter, the boundaries between fields are ambiguous. Attackers can move bytes from one field into another without changing the resulting message string.
Root Cause
The root cause is unseparated concatenation of variable-length fields prior to HMAC computation, combined with an asymmetric message definition between signer and verifier. Signing message token || state || redirect || domain and verifying message token || state || redirect allows a caller to place attacker-controlled data spanning the redirect and domain fields such that the two messages produce identical bytes. The signature returned by step 1 therefore validates against a step 2 request under a different field interpretation.
Attack Vector
An unauthenticated attacker sends a crafted request to the wdpsso_step1 AJAX endpoint to obtain a valid HMAC over their chosen inputs. The attacker then submits a follow-up request to wdpsso_step2, restructuring the parameters so that the value originally supplied as domain is appended to the redirect value. The concatenated string passed to HMAC verification matches the string signed in step 1. The plugin accepts the signature as valid and establishes an authenticated administrator session for the attacker on the target WordPress site. See the Wordfence Vulnerability Analysis for additional context.
Detection Methods for CVE-2026-76581
Indicators of Compromise
- Requests to admin-ajax.php with the action=wdpsso_step1 or action=wdpsso_step2 parameters from unexpected source addresses
- Paired step 1 and step 2 requests from the same client within a short interval, especially where the step 2 redirect parameter contains a domain-like suffix
- New administrator sessions or authentication cookies issued without a corresponding successful wp-login.php POST
- Unexpected changes to WordPress options, users, or plugin state following Hub SSO traffic
Detection Strategies
- Alert on unauthenticated POST requests to admin-ajax.php targeting wdpsso_step1 and wdpsso_step2 actions
- Correlate step 1 responses containing an HMAC value with subsequent step 2 requests reusing the same token and state values
- Monitor for administrator privilege use immediately following Hub SSO AJAX activity
Monitoring Recommendations
- Enable verbose WordPress access logging for admin-ajax.php and retain request bodies where policy allows
- Track creation of new administrator accounts, role changes, and plugin or theme installations after Hub SSO handshakes
- Forward WordPress and web server logs to a centralized analytics platform to enable historical review across sites
How to Mitigate CVE-2026-76581
Immediate Actions Required
- Update the WPMU DEV Dashboard plugin to a version later than 5.0.1 as soon as the vendor publishes a fixed release
- Disable Hub SSO in the WPMU DEV Dashboard configuration until the plugin is patched
- Audit administrator accounts and active sessions for unauthorized entries and revoke suspicious sessions
- Rotate WordPress secret keys in wp-config.php and reset administrator credentials on affected sites
Patch Information
Refer to the WPMU DEV Dashboard project page and the Wordfence Vulnerability Analysis for the current fixed version and vendor guidance. Apply the patched release across all managed WordPress sites that use the plugin.
Workarounds
- Disable the Hub SSO feature within the plugin settings to remove the vulnerable code path
- Restrict access to admin-ajax.php at the web application firewall to block requests carrying the wdpsso_step1 and wdpsso_step2 actions from untrusted sources
- Disconnect the site from the WPMU DEV Hub if SSO is not required for operations
- Enforce IP allowlists on WordPress administrative endpoints until a fixed plugin version is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
