CVE-2026-76581

Name of the Vulnerable Software and Affected Versions WPMU DEV Dashboard versions prior to 5.0.2

Description An authentication bypass exists in the Hub Single Sign-On (SSO) flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a protocol design failure where the signer and verifier disagree on the message structure—between two unauthenticated AJAX endpoints: 'wdpsso step1' and 'wdpsso step2'.

In 'wdpsso step1', the system signs a concatenation of token, state, redirect, and domain without delimiters. However, 'wdpsso step2' verifies a concatenation that omits the domain field. An attacker can use 'wdpsso step1' as a signing oracle by providing an empty redirect value to obtain a valid HMAC for the combined token, state, and domain. By replaying this HMAC to 'wdpsso step2' and moving the domain value into the redirect field, the resulting byte string remains identical, causing the verification to succeed. This allows an unauthenticated attacker to obtain an authenticated administrator session if Hub SSO is enabled and mapped to an administrator. If the WordPress theme or plugin editor is accessible, this can lead to full site takeover and remote code execution via PHP modification.

Recommendations Update WPMU DEV Dashboard to version 5.0.2. As a temporary workaround, disable Hub SSO.