WPMU DEV Dashboard Patches a Second Critical Authentication Bypass in Three Weeks

WPMU DEV Dashboard, a WordPress plugin that connects sites to WPMU DEV’s hosted management platform on an estimated 350,000 active installations, patched a critical authentication bypass on August 24, 2026, that let unauthenticated attackers become site administrators. Wordfence, which found and reported the flaw through its Argus vulnerability research tool, assigned it CVE-2026-76581 and a CVSS score of 9.8, near the top of the critical scale. The bug worked against any site that had Hub Single-Sign On enabled and connected to an administrator account, and it required no prior access to exploit.

A Mismatched Signature Between Two Login Steps

WPMU DEV Dashboard’s Hub SSO flow lets a logged-in WPMU DEV user sign into a connected WordPress site without a separate password, using two unauthenticated AJAX actions named wdpsso_step1 and wdpsso_step2. According to Wordfence’s technical writeup, the first step generates a token and a state value, then signs them together with a redirect URL and the site’s domain using HMAC-SHA256, with all four values concatenated and no separators between them. The second step verifies a signature built the same way, except it leaves the domain value out of the calculation entirely.

That mismatch is what made the bug exploitable. An attacker could request a valid signature from step one, then replay it against step two after moving the domain value into the redirect field, a substitution the unseparated concatenation could not tell apart from a legitimate request. Wordfence says the result was a fully authenticated administrator session, reached with nothing more than those two unauthenticated AJAX requests: no password, credential, or prior session with the site was ever needed. From there, an attacker with access to WordPress’s built-in plugin or theme editor could turn that admin session into remote code execution.

A Patch Within Five Days

Wordfence researcher Alex Thomas discovered the flaw on August 19, 2026, and reported it to WPMU DEV the same day through Wordfence’s Vulnerability Management Portal. WPMU DEV acknowledged the report and submitted a pre-release patch for review two days later, then shipped the fix publicly as version 5.0.2 on August 24. Wordfence pushed a firewall rule to its Premium, Care, and Response customers on August 25, one day after the public patch, a gap the company said was necessary because the rule is a “feature breaking” one rather than a simple malformed-request block. Free Wordfence users are scheduled to receive the same protection on September 24, the standard 30-day gap Wordfence gives free-tier users behind paying customers on new firewall rules.

The Second Unauthenticated Takeover Bug in Three Weeks

This is not WPMU DEV Dashboard’s first unauthenticated path to full site control this month. On August 6, Wordfence disclosed a separate flaw, tracked as CVE-2026-15459 and credited by Patchstack to researcher Austin Ginder, affecting every version up to 5.0.0. That bug worked differently: on any site that had never connected to the WPMU DEV Hub, the plugin’s default state right after installation, the API key used to sign Hub requests was blank, making its request signature trivial to forge. Version 5.0.0 had also dropped a replay check, and the vulnerable handler ran on WordPress’s public init hook with no capability check at all. According to a GitHub Security Advisory documenting the bug, that combination let an unauthenticated visitor install and activate a plugin from an attacker-controlled URL for remote code execution, delete plugins and themes, upgrade WordPress core outright, or sign in through SSO as an administrator. Both Patchstack and GitHub rated it CVSS 8.1.

WPMU DEV fixed that first bug in version 5.0.1. That is exactly the version the new SSO bypass affects: the release meant to close one unauthenticated admin-takeover path shipped carrying a second one, rooted in a different part of the same Hub connection and SSO system.

Any site running WPMU DEV Dashboard 5.0.1 or earlier should update to 5.0.2 immediately. Wordfence recommends that site owners who cannot update right away disable Hub SSO until the patched version is installed.