Wordfence says its Argus research tool uncovered a critical authentication bypass in the WPMU DEV Dashboard WordPress plugin, a flaw that could let unauthenticated attackers reach administrator access on sites using Hub Single-Sign On. The issue affects versions up to and including 5.0.1, was assigned CVE-2026-76581, and was rated 9.8 on the CVSS scale.
What Wordfence found in WPMU DEV Dashboard
According to Wordfence, the vulnerability exists in the plugin’s Hub SSO flow when the feature is enabled on a connected site. The plugin is estimated to have about 350,000 active installations, which makes the issue especially significant for WordPress site owners using the service to connect to WPMU DEV.
Wordfence describes the flaw as an authentication bypass caused by inconsistent HMAC message construction between two unauthenticated AJAX actions, wdpsso_step1 and wdpsso_step2. In practical terms, that mismatch made it possible to reuse a valid signature from the first step of the login flow in the second step by shifting the site domain into the redirect field.
Why the bug mattered
The plugin’s SSO steps are intentionally reachable without prior WordPress authentication because the login exchange starts before the user has a session. But that also means each request has to be validated in a way that cannot be confused or rearranged by an attacker.
Wordfence says the problem was that step 1 and step 2 did not sign the exact same byte sequence. Step 1 included the token, hashed state, redirect value and domain, while step 2 verified only the token, state and redirect. Because the fields were concatenated without separators or length prefixes, the same bytes could be interpreted differently across the two steps.
How the attack chain worked
The advisory says an attacker could request step 1 with an empty redirect value, receive a valid HMAC, and then replay that HMAC in step 2 while placing the returned domain value into the redirect field. That made step 2 reconstruct the same byte string that step 1 had signed, even though the fields had different logical meanings.
Wordfence says the attacker did not need the WPMU DEV API key. Instead, step 1 effectively acted as a signing oracle, returning a valid HMAC that step 2 would accept when the values were rearranged in this way.
What happened after validation
The rest of the login checks did not block the attack, Wordfence said. The first step set a pre-SSO state cookie and returned the matching state value, while also generating and storing an active token. That allowed an unauthenticated user to satisfy the state and token checks if they preserved the cookie and reused the values provided by step 1.
Once those checks passed, the plugin created an authentication cookie for the WordPress user configured for Hub SSO. On sites where Hub SSO was mapped to an administrator account, the result was a full admin session and, in effect, complete site takeover.
Impact on connected WordPress sites
Wordfence notes that the vulnerability is distinct from an earlier WPMU DEV Dashboard authentication bypass affecting versions up to 5.0.0. That previous issue involved empty-key WDP-AUTH validation and affected unconnected sites through a remote-request path. This newer flaw affects connected sites with Hub SSO enabled and remained exploitable in 5.0.1.
In the worst case, administrator access can lead to remote code execution if the site also exposes an admin-accessible code-write mechanism, such as the WordPress plugin or theme editor. Even without that extra condition, admin access is enough to change site content, install plugins, alter users and control core settings.
Patch and vendor response
Wordfence said it disclosed the issue to WPMU DEV on August 19, 2026, the same day it was discovered. The developer acknowledged the report and submitted a pre-release patch on August 21, which Wordfence reviewed. The vendor then released version 5.0.2 to the public on August 24, 2026.
The company also praised WPMU DEV for its response. In Wordfence’s disclosure timeline, the pre-release patch was confirmed to block the HMAC reuse behavior before public release.
What changed in version 5.0.2
Wordfence says the patch stores the HMAC generated in step 1 server-side and checks that value during step 2. The updated logic also rejects requests when the incoming signature matches the step 1 signature, preventing the replay trick used in the bypass.
In testing the patched build, Wordfence says replaying the step 1 HMAC in step 2 was rejected and did not create a wordpress_logged_in cookie. A separate positive-control test using the legitimate step-2 HMAC still completed the SSO flow as expected.
Protection for Wordfence users
Wordfence Premium, Wordfence Care and Wordfence Response customers received a firewall rule on August 25, 2026. Free users are scheduled to receive the same rule on September 24, 2026, 30 days later. Wordfence said the rule was deployed one day after the patch became public because it is feature-breaking.
For site owners, the most immediate advice is simple: update WPMU DEV Dashboard to version 5.0.2 as soon as possible. If updating is not immediately possible, Wordfence recommends disabling Hub SSO until the patched version is installed.
What site owners should do now
- Check whether WPMU DEV Dashboard is installed on any connected WordPress site.
- Confirm the plugin is updated to version 5.0.2.
- If you cannot update right away, disable Hub SSO temporarily.
- Review whether the mapped SSO account has administrator privileges.
- Watch for unusual login activity or unexpected administrative changes.
Given the severity rating and the ability to reach administrator access without authentication, this is the kind of issue that can move quickly from theoretical to practical if left unpatched. For any site relying on Hub SSO, the safest path is to verify the fix and reduce exposure immediately.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: August 28, 2026 at 1:52 am
0 views
