CVE-2026-76581 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

The WPMU DEV Dashboard plugin for WordPress (≤ 5.0.1) contains an authentication‑bypass flaw that lets an unauthenticated remote actor obtain a valid administrator session. All WordPress sites that have Hub SSO enabled and map the plugin to an admin account are immediately exposed to full site takeover. Decision makers must authorize emergency patching or mitigation, isolate affected sites, and trigger incident response within the next 24 hours.

Verified Facts

• CVE‑2026‑76581 describes an authentication bypass in the WPMU DEV Dashboard plugin for WordPress up to version 5.0.1 – NVD.
• The bypass stems from inconsistent HMAC construction between the unauthenticated wdpsso_step1 and wdpsso_step2 AJAX actions – NVD.
• Exploitation allows an attacker to replay a valid HMAC from step 1 to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session – NVD.
• The vulnerability is scored CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H – NVD.
• The vulnerability is classified under CWE‑347 (Improper Verification of Cryptographic Signature) – NVD.

Threat Classification

Authentication‑bypass privilege escalation affecting WordPress installations that use the WPMU DEV Dashboard plugin (global reach) – (HIGH CONFIDENCE). The vulnerability is currently unexploited in the wild but a proof‑of‑concept exists, making the threat status “potentially active” – (MEDIUM CONFIDENCE). Attacker motivation is straightforward: obtain full administrative control of the target site – (HIGH CONFIDENCE).

Threat Severity Assessment

• Remote network exploit with no authentication required – (HIGH CONFIDENCE).
• Full administrator compromise (confidentiality, integrity, availability impact) – (HIGH CONFIDENCE).
• Critical CVSS 9.8 rating confirms extreme severity – (HIGH CONFIDENCE).
• Widespread adoption of WordPress and the plugin expands the attack surface – (MEDIUM CONFIDENCE).

Business Impact

An attacker who gains an admin session can deface the site, inject malicious code, or exfiltrate personal data, triggering GDPR breach notifications with fines up to €20 million or 4 % of global turnover. For operators of critical infrastructure under NIS2, the breach could be classified as a “significant incident,” incurring mandatory reporting and potential sanctions. Immediate financial exposure includes incident response (average $150k), downtime loss, and brand remediation costs, while reputational damage can erode user trust and SEO rankings.

Technical Analysis

• Attack vector: Unauthenticated HTTP POST to /wp-admin/admin-ajax.php?action=wdpsso_step1 to obtain a signed HMAC token.
• Exploitation chain: The attacker reuses the token in a second POST to /wp-admin/admin-ajax.php?action=wdpsso_step2, moving the original domain value into the redirect parameter, bypassing the missing domain verification.
• Affected component: WPMU DEV Dashboard plugin’s AJAX actions wdpsso_step1 and wdpsso_step2 (versions ≤ 5.0.1).
• Root cause: Ambiguous concatenation of token, state, redirect, and domain fields during HMAC generation versus verification, leading to CWE‑347.
• Impact: Successful request creates a valid WordPress authentication cookie (wordpress_logged_in_*) granting full admin privileges.
• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H – NVD.

CVE Analysis

• CVE‑2026‑76581 – WPMU DEV Dashboard plugin for WordPress ≤ 5.0.1 – CWE‑347 – Network‑remote, No authentication required – Patch available in version 5.0.2 (or later) – NVD.

MITRE ATT&CK Mapping

• Credential Access → T1078 Valid Accounts — The attacker obtains a valid admin session without credentials by exploiting the authentication bypass.
• Privilege Escalation → T1068 Exploitation for Privilege Escalation — The vulnerability is leveraged to elevate from unauthenticated to administrator level.
• Command and Control → T1102 Web Service — The attack uses WordPress AJAX endpoints as the communication channel.

IOC Intelligence

No public IOCs confirmed at time of publication.

Defenders should build hunt rules around the following behavioral indicators:

• Unauthenticated POST to admin-ajax.php with action=wdpsso_step1 followed within 5 seconds by a POST with action=wdpsso_step2 sharing the same token value.
• Presence of a redirect parameter containing a full domain (e.g., https://example.com) while the domain parameter is omitted in the same request.
• Creation of a wordpress_logged_in_* cookie from an IP address that has no prior successful login events.
• Repeated 200 OK responses from the two AJAX actions originating from the same source IP within a short time window (≤ 10 seconds).

Detection Engineering Guidance

Collect the following logs:

• Web server access logs (Apache/Nginx) – filter for POST /wp-admin/admin-ajax.php with query string action=wdpsso_step1 or action=wdpsso_step2.
• WordPress debug or PHP error logs – capture $_POST['token'] and $_POST['redirect'] values.
• WAF logs – alert on POST requests to the AJAX endpoint from unauthenticated sessions.
• Application authentication logs – monitor creation of wordpress_logged_in_ cookies without preceding login events.

Detection logic: correlate a step1 request (no auth cookie) with a step2 request (same token, manipulated redirect) occurring within

🔗 Related Intelligence Reports

• Related topic: CVE-2026-82244 — CVSS 9.1 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-81702 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-82082 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-81707 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-81735 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record