HMAC canonicalization mismatch in WPMU DEV Dashboard SSO lets unauthenticated attackers log in as administrator (CVE-2026-76581)
Wordfence and Patchstack report in-the-wild exploitation of this unauthenticated administrator bypass and a fixed release (5.0.2) is available, so sites with Hub SSO enabled that delay face full admin takeover.
The plugin's unauthenticated wdpsso_step1 and wdpsso_step2 AJAX actions build HMAC messages inconsistently — step 1 signs and discloses an unseparated concatenation of token, state, redirect, and domain, while step 2 verifies a concatenation that omits the domain. An unauthenticated attacker can exploit this ambiguity on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator to authenticate as that administrator and take over the site.
Affected: WPMU DEV Dashboard plugin for WordPress <= 5.0.1
How to Test
Confirm the installed WPMU DEV Dashboard version — anything at or below 5.0.1 is vulnerable. Check whether the site is connected to WPMU DEV with Hub SSO enabled and mapped to an administrator account. Review web server logs for unauthenticated requests to the wdpsso_step1 and wdpsso_step2 AJAX actions, and audit administrator sessions and accounts for unrecognized activity.
How to Patch
Update the WPMU DEV Dashboard plugin to version 5.0.2, the patched version identified by Patchstack. As an interim stop-gap, disable Hub SSO on connected sites until the update is applied. On sites where SSO was enabled, verify no new administrator accounts or sessions were created before patching, and rotate credentials for any admin accounts that show suspicious activity.