A WordPress plugin running on an estimated 350,000 sites will hand an anonymous visitor an administrator session, on any install where its single sign-on feature is switched on. Wordfence researcher Alex Thomas found the flaw in WPMU DEV Dashboard on August 19, 2026. It is tracked as CVE-2026-76581 and rated 9.8 out of 10.
WPMU DEV Dashboard is the connector agencies use to manage client sites from the WPMU DEV Hub, and its Hub SSO flow lets an authorized Hub user drop straight into a connected WordPress site as a preconfigured user, which in practice is usually an administrator. Thomas published the full analysis on August 27, crediting Wordfence Argus, the company's automated research system, with helping surface it.
Two signatures that do not agree
The SSO exchange runs in two steps, and both are deliberately reachable without logging in, because the visitor is not authenticated to WordPress yet. Both protect themselves with an HMAC, a keyed signature meant to prove a message really came from the Hub. The problem is that the two steps do not sign the same message.
Step one signs the token, the hashed state value, the redirect and the site domain, glued together. Step two verifies the token, the state and the redirect, and leaves the domain out entirely. Neither puts separators between the fields. That is the whole flaw: with nothing marking where one field ends and the next begins, a single run of bytes can be read as two different sets of values.
Step one will sign it for you
An attacker calls step one with an empty redirect. The plugin dutifully signs token, state and domain, then returns the signature along with every non-secret value needed to carry on. The attacker replays that same signature to step two, this time putting the returned domain string into the redirect field. Step two assembles token, state and redirect, produces the identical byte string, and the comparison passes. The plugin then issues an authentication cookie for the SSO user.
At no point does the attacker need the WPMU DEV API key. Step one is a signing oracle for step two. The replay defences do not help either, because step one is what hands out the fresh token and sets the state cookie that those checks go on to validate. Where the SSO user is an administrator and an administrator can reach the plugin or theme editor, site takeover extends to running code on the server.
Update to 5.0.2, or turn Hub SSO off
Wordfence reported the issue to WPMU DEV the day it was found. The vendor sent a pre-release patch for review on August 21 and shipped version 5.0.2 publicly on August 24. Everything up to and including 5.0.1 is affected. Sites that cannot update straight away should disable Hub SSO until they can, which removes the reachable path. Wordfence deployed a firewall rule to its Premium, Care and Response customers on August 25, a day behind the patch because the rule breaks the feature, with free users due to receive it on September 24.
This is the second serious authentication bypass reported in this plugin inside a month. The earlier one, in versions 5.0.0 and below, let attackers install arbitrary plugins. A connector trusted to log people into hundreds of client sites is a high-value target precisely because logging people in is its job, and twice now that is where it has broken. The same automated research system behind this find also chained six bugs into a takeover of the Avada theme earlier this month, which suggests the flow of findings in this ecosystem is about to get faster, not slower.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.