CVE-2026-103646

Name of the Vulnerable Software and Affected Versions Ultimate Multisite WordPress plugin versions prior to 2.17.0

Description An authentication bypass exists where a logged-out checkout can be linked to and logged in as an existing WordPress account matching the submitted email address. This occurs because the duplicate-account check normalizes the email address differently than the lookup used to create the customer. An unauthenticated attacker can exploit this to log in as any existing user, including a Network Super Admin, provided they know the user's email address. This issue requires a checkout form configured without a password field (using auto-generated passwords) and a target account that lacks an existing customer record within the plugin.

Recommendations Update Ultimate Multisite WordPress plugin to version 2.17.0 or later.