As cited
Copy frozen at (site build).
vulnerabilities
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
Wordfence discovered CVE-2026-76581, a critical authentication bypass vulnerability in WPMU DEV Dashboard plugin affecting versions up to 5.0.1. The flaw stems from inconsistent HMAC canonicalization in the Hub single-sign-on flow, allowing unauthenticated attackers to replay a signature from step 1 to step 2 by repositioning the domain field, resulting in administrator access on affected sites. WPMU DEV released patch version 5.0.2 on August 24, 2026, and Wordfence deployed firewall rules on August 25, 2026 for premium users and September 24, 2026 for free users.
Why it matters: WordPress site operators using WPMU DEV Dashboard with Hub SSO enabled and mapped to administrator accounts need to update immediately to version 5.0.2 or disable Hub SSO, as unauthenticated attackers can gain full administrator access and execute arbitrary code.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
Wordfence discovered CVE-2026-76581, a critical authentication bypass vulnerability in WPMU DEV Dashboard plugin affecting versions up to 5.0.1. The flaw stems from inconsistent HMAC canonicalization in the Hub single-sign-on flow, allowing unauthenticated attackers to replay a signature from step 1 to step 2 by repositioning the domain field, resulting in administrator access on affected sites. WPMU DEV released patch version 5.0.2 on August 24, 2026, and Wordfence deployed firewall rules on August 25, 2026 for premium users and September 24, 2026 for free users.
Why it matters: WordPress site operators using WPMU DEV Dashboard with Hub SSO enabled and mapped to administrator accounts need to update immediately to version 5.0.2 or disable Hub SSO, as unauthenticated attackers can gain full administrator access and execute arbitrary code.
- Source published
- First seen by Cybersecurity Tracker