CVE-2026-76581— WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
Quick assessment
Affected
wpmudev WPMU DEV Dashboard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 WPMU DEV Dashboard 插件在 5.0.1 及之前所有版本中均存在身份验证绕过漏洞。其根源在于未认证的 和 两个 AJAX 动作之间的 HMAC 消息构造不一致且存在歧义：步骤 1 会对令牌（token）、状态（state）、重定向（redirect）和域名（domain）四个值拼接成的字符串进行签名并披露，而步骤 2 在验证时所使用的拼接字符串中省略了域名字段。这一差异使得未认证的攻击者能够在启用了 Hub SSO 并将管理员账户进行映射的 WPMU DEV 站点上，从步骤
Possible ATT&CK Techniques 2 AI
T1056 · Input Capture T1557.001 · Name Resolution Poisoning and SMB Relay
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76581
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
Source: CVE Program / CVE List V5
Vulnerability Description
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wpmudev | WPMU DEV Dashboard | 0 ~ 5.0.1 | - |
|
II. Public POCs for CVE-2026-76581
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76581
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-76581 (1)
Vendor Pages for CVE-2026-76581 (1)
IV. Related Vulnerabilities
Same vendor: wpmudev
-
CVE-2026-18324
Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross- -
CVE-2026-18328
Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross -
CVE-2026-18323
Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross- -
CVE-2026-15748
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File -
CVE-2026-12998
Forminator Forms <= 1.55.0.2 - Insecure Direct Object Refere
Same weakness: CWE-347
-
CVE-2026-54330
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on p -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File -
CVE-2026-81714
openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enr -
CVE-2026-81701
openssl_encrypt before 1.4.9 Arbitrary Code Execution via un -
CVE-2026-81700
openssl_encrypt before 1.4.9 GPG Signature Verification Bypa
V. Comments for CVE-2026-76581
No comments yet