WPMU DEV Dashboard

Wordfence published CVE-2026-76581 on August 27, 2026 for WPMU DEV Dashboard, a WordPress plugin used to connect sites to WPMU DEV services. Wordfence estimates 350,000 active installations. The vulnerability allows unauthenticated attackers to obtain an administrator session on connected sites where Hub Single Sign-On is enabled and mapped to an administrator account.

The issue affects WPMU DEV Dashboard versions up to and including 5.0.1 and is fixed in 5.0.2. This is distinct from the earlier WPMU DEV Dashboard authentication bypass in versions up to 5.0.0; this new issue involves the Hub SSO flow and remains exploitable in 5.0.1 under the affected configuration.

Vulnerability Summary

• CVE: CVE-2026-76581
• Severity: CVSS 9.8 critical
• Plugin: WPMU DEV Dashboard
• Slug: wpmudev-updates
• Affected versions: all versions up to and including 5.0.1
• Fixed version: 5.0.2
• Required access: none
• Required condition: site connected to WPMU DEV with Hub SSO enabled and mapped to an administrator
• Impact: administrator session creation and complete site takeover

Technical Cause

The vulnerable SSO flow uses two unauthenticated AJAX actions, wdpsso_step1 and wdpsso_step2. Unauthenticated exposure is expected for an SSO handshake, but the two steps must construct and validate the same message unambiguously.

According to Wordfence, step 1 signs a concatenation of token, state, redirect, and domain values. Step 2 verifies a concatenation of token, state, and redirect values while omitting the domain field. Because the fields are concatenated without delimiters or length prefixes, the same byte string can be interpreted differently by each step. Step 1 becomes a signing oracle, and step 2 can accept the resulting signature under a different field layout.

When the SSO checks pass, the plugin creates a WordPress authentication cookie for the user configured for Hub SSO. If that mapped user is an administrator, the attacker receives an administrator session.

Immediate Remediation

• Update WPMU DEV Dashboard to 5.0.2 or newer immediately.
• If the update cannot be deployed immediately, disable Hub SSO until the patched version is installed.
• Confirm which WordPress user is mapped to Hub SSO and avoid mapping SSO to a standing administrator account where possible.
• Review administrator logins and unknown sessions since August 19, 2026.
• Rotate administrator credentials and invalidate sessions if suspicious SSO activity is found.

WP-CLI Verification

wp plugin get wpmudev-updates --fields=name,version,status
wp plugin update wpmudev-updates
wp plugin get wpmudev-updates --field=version

Review administrator accounts and recently created users after patching.

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp db query "SELECT ID,user_login,user_email,user_registered FROM {prefix}users WHERE user_registered >= DATE_SUB(NOW(), INTERVAL 14 DAY);"

Log Review

Look for unauthenticated SSO AJAX activity followed by an administrator session from the same IP or user agent. Do not replay payloads; use logs and SSO configuration review defensively.

# Adjust log paths for your host.
grep -Ei 'wdpsso_step1|wdpsso_step2|admin-ajax.php' /var/log/nginx/access.log*
grep -Ei 'wdpsso_step1|wdpsso_step2|admin-ajax.php' /var/log/apache2/access.log*

Temporary Mitigation

The permanent fix is WPMU DEV Dashboard 5.0.2 or newer. If patching is delayed, disable Hub SSO or block unauthenticated access to the two SSO AJAX actions at the edge. Test any WAF rule carefully, because it will break Hub SSO until removed.

# Conceptual WAF rule, not a replacement for updating:
# if path == '/wp-admin/admin-ajax.php'
# and request contains action=wdpsso_step1 or action=wdpsso_step2:
#     block until WPMU DEV Dashboard is patched

Sources

• Wordfence WPMU DEV Dashboard advisory
• Wordfence Intelligence CVE-2026-76581 record
• WPMU DEV Dashboard documentation