What the vulnerability does
01Description
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
Explanation of Vulnerability in Simple Terms
02Summary
The WPMU DEV Dashboard does not properly verify cryptographic signatures on data, allowing attackers to forge or tamper with signed messages without authentication. An attacker can exploit this over the network to gain unauthorized access, modify site data, or disrupt service. All versions up to 5.0.1 are affected.
What an attacker can do
03Attacker Capabilities
Forge or tamper with cryptographic signatures to bypass authentication and gain unauthorized access to the dashboard.
Potential impact on your site
04Site Impact
Attackers can compromise the WPMU DEV Dashboard without credentials, potentially gaining control over site management functions.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 28, 2026
CVE published
August 28, 2026
Record updated
