CVE-2026-76581

Name of the Vulnerable Software and Affected Versions WPMU DEV Dashboard versions prior to 5.0.2

Description An authentication bypass exists in the Hub SSO flow, potentially affecting approximately 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a flaw where data is interpreted differently during signing and verification—between two unauthenticated AJAX actions: wdpsso step1 and wdpsso step2. In wdpsso step1, the system signs an unseparated concatenation of the token, state, redirect, and domain variables. However, wdpsso step2 verifies a concatenation that omits the domain field. An attacker can use wdpsso step1 as a signing oracle by requesting a signature with an empty redirect field and then replaying that signature to wdpsso step2 by moving the domain value into the redirect field. Because the resulting byte strings are identical, the verification passes, allowing an unauthenticated attacker to obtain an authenticated administrator session and potentially achieve full site takeover or remote code execution if the plugin or theme editor is accessible.

Recommendations Update to version 5.0.2. As a temporary mitigation, disable Hub SSO.