Critical Vulnerability Exposed in WPMU DEV Dashboard Plugin for WordPress
A significant security issue has been unearthed in the WPMU DEV Dashboard plugin for WordPress, which may open the door for unauthenticated attackers to assume administrative control over compromised websites that are utilizing Hub Single Sign-On (SSO) features. This vulnerability, cataloged under CVE-2026-76581, has been assigned a notably high CVSS score of 9.8, indicating its severe potential impact.
Overview of the Vulnerability
The WPMU DEV Dashboard plugin, which boasts around 350,000 active installations, is currently vulnerable in versions 5.0.1 and earlier. In response to this alarming issue, WPMU DEV launched version 5.0.2 on August 24, 2026, intending to address the significant security flaw.
Alex Thomas, a researcher associated with Wordfence, in collaboration with the company’s AI-powered vulnerability research system, Argus, was the first to identify this vulnerability on August 19. The problem fundamentally resides in how the plugin validates HMAC-SHA-256 signatures during the Hub SSO authentication process, leading to a potentially perilous scenario for users.
Technical Details of the Flaw
The vulnerability arises from inconsistencies in the plugin’s handling of HMAC signatures throughout the two-stage SSO authentication process. Initially, two unauthenticated AJAX actions—wdpsso_step1 and wdpsso_step2—are used for authenticating users on the compromised site before they can log in to WordPress.
During the initial authentication phase, the plugin generates an HMAC signature based on a concatenation of four critical values: token, hashed state, redirect URL, and site domain. Notably, these values are combined without any delimiters or length prefixes, making it easier for attackers to exploit the ambiguous nature of the signed data.
When the process transitions to the second step, the plugin only verifies an HMAC constructed from three values—token, state, and redirect—overlooking the domain entirely. This omission creates a condition of canonicalization confusion, offering attackers a distinctive opportunity to launch an exploitation attempt.
By initiating the first step without providing a redirect parameter, an attacker can manipulate the HMAC signature to cover a specific byte sequence: token combined with state and domain. This crafted signature can subsequently be submitted to the second endpoint along with an aliasing of the domain in the redirect space, allowing the attacker to bypass security measures effectively.
Access and Implications
The attack does not necessitate the disclosure of the WPMU DEV API key, as the unauthenticated first-stage endpoint acts as a signing oracle. Thus, it generates a valid HMAC that can be seamlessly leveraged in alternate contexts. Additional anti-replay controls implemented within the plugin do not counteract this vulnerability since attackers receive a fresh token, a hashed state, and the necessary pre-SSO cookie during the first phase.
If the attacker successfully navigates through these steps, they can validate the signature and utilize WordPress’s authentication functions to establish a session associated with an account linked to Hub SSO. In the unfortunate event that the compromised account possesses administrative privileges, the attacker could effectively seize control of the entire WordPress installation.
Such unauthorized access not only jeopardizes the integrity of the website but may also enable a host of malicious activities—including the installation of rogue plugins, alterations to themes, theft of sensitive credentials, and unauthorized data access. In extreme situations, this flaw could even lead to remote code execution through WordPress’s built-in code editing functionalities.
Actions Required
This newly identified vulnerability significantly diverges from a previous issue that affected WPMU DEV Dashboard versions up to 5.0.0, which revolved around empty-key WDP-AUTH validation. The current vulnerability persists in version 5.0.1 and explicitly targets sites that have Hub SSO enabled.
To address this flaw, the 5.0.2 patch introduced by WPMU DEV ensures that the HMAC generated during the first step is stored on the server side. If an attempt is made to replay this signature in the second step, the server will outright reject it. Testing has substantiated that the patched version effectively blocks the replay attack without issuing a wordpress_logged_in cookie.
In light of this significant vulnerability, administrators are urgently advised to upgrade to version 5.0.2 or later without delay. Organizations unable to promptly implement the patch should consider disabling the Hub SSO feature until the update can be fully integrated. The necessity of immediate action cannot be overstated, given the potential repercussions of rising cyber threats targeting WordPress sites.