CVE-2026-76581: WPMU DEV Dashboard Authentication Bypass (CVSS 9.8) — Detection and Remediation Guide for WordPress Defenders

On the surface, CVE-2026-76581 looks like another entry in the long parade of WordPress plugin vulnerabilities. It is not. With a CVSS score of 9.8 (CRITICAL, network-exploitable, no authentication required, no user interaction), this flaw in the WPMU DEV Dashboard plugin gives an unauthenticated remote attacker a direct path to administrator-level access on any WordPress site that meets three conditions: the WPMU DEV Dashboard plugin is installed at version 5.0.1 or earlier, the site is connected to a WPMU DEV Hub account, and Hub SSO is enabled and mapped to an administrator account.

The root cause is a cryptographic implementation error — inconsistent and ambiguous HMAC message construction between two unauthenticated AJAX endpoints. This is a textbook example of why HMAC is only as strong as the message you feed into it. If your organization runs WordPress sites managed through WPMU DEV, treat this as an emergency patch event.

What Happened

NVD published CVE-2026-76581 detailing an Authentication Bypass vulnerability in the WPMU DEV Dashboard plugin for WordPress. All versions up to and including 5.0.1 are affected.

The vulnerability lives in the plugin's Hub SSO (single sign-on) flow, which is implemented through two unauthenticated AJAX actions:

• wdpsso_step1 — signs and discloses an HMAC computed over an unseparated concatenation of the token, state, redirect, and domain values.
• wdpsso_step2 — verifies an HMAC computed over an unseparated concatenation that omits the domain field.

Two distinct defects compound here:

1. Ambiguous message construction. Concatenating variable-length fields without a delimiter or length prefix makes the signed message non-canonical. Different combinations of field values can produce identical concatenated strings — the classic [ab][c] vs. [a][bc] ambiguity. An attacker who can influence the token, state, or redirect values can craft inputs that collide under this scheme.

2. Sign/verify mismatch. Step 1 signs token + state + redirect + domain, while step 2 verifies token + state + redirect. Because step 1 discloses the HMAC it computed, and step 2 verifies a message constructed from a subset of the same fields, an attacker can manipulate field boundaries to produce a step-1 output that satisfies step-2 verification — without ever possessing the signing key.

The end result: an unauthenticated attacker, against a site connected to WPMU DEV with Hub SSO enabled and mapped to an administrator account, can complete the SSO flow and obtain an authenticated administrator session.

Why This Is Severe

• CVSS 9.8 — Network attack vector, low complexity, no privileges required, no user interaction, with high impact across confidentiality, integrity, and availability.
• WordPress admin = full site control. An attacker with admin access can install malicious plugins or themes, inject web shells into theme files, create backdoor administrator accounts, modify the wp-config.php file, and pivot into the underlying server.
• WPMU DEV Dashboard is widely deployed on agency-managed and MSP-managed WordPress fleets, meaning a single exploitation playbook scales across many sites.

Exploitation Status

At the time of publication, check the NVD entry and CISA KEV catalog for current status. Given the CVSS 9.8 rating, the unauthenticated attack path, and the fact that the vulnerable endpoints are directly reachable over the network, defenders should operate on the assumption that weaponized exploitation will follow disclosure quickly — WordPress plugin auth bypasses historically see mass scanning within days. Do not wait for confirmed in-the-wild exploitation to patch.

Affected Products

Exposure prerequisites for exploitation:

• Site connected to a WPMU DEV Hub account
• Hub SSO enabled
• SSO mapped to an administrator account

Sites running the plugin without Hub SSO enabled are at lower immediate risk, but patching is still mandatory — configuration drift happens, and the vulnerable code paths remain present.

Detection & Response

What to Look For

The attack surface is two AJAX actions delivered through WordPress's standard admin-ajax.php endpoint. Observable indicators:

• HTTP POST requests to /wp-admin/admin-ajax.php with action=wdpsso_step1 or action=wdpsso_step2 in the request body from IP addresses that are not your WPMU DEV Hub infrastructure or expected administrator ranges.
• wdpsso_step2 requests that do not follow a corresponding wdpsso_step1 request from the same source — a sign of HMAC replay or crafting attempts.
• Repeated sequences of step1/step2 requests with varying parameters — characteristic of boundary-collision fuzzing against the concatenated HMAC message.
• Successful admin logins via SSO (/wp-login.php or admin-ajax flows) from unfamiliar IPs, especially followed by plugin/theme installation or file modification.

Sigma Rules

---
title: WPMU DEV Hub SSO Endpoint Access (CVE-2026-76581)
id: 3f8a2c41-9b7e-4d52-a1c8-6e4f0b2d9a31
status: experimental
description: Detects HTTP requests to the unauthenticated wdpsso_step1/wdpsso_step2 AJAX actions in the WPMU DEV Dashboard plugin, the attack surface for CVE-2026-76581 authentication bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76581
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains: 'admin-ajax.php'
  selection_action_step1:
    cs-body|contains: 'action=wdpsso_step1'
  selection_action_step2:
    cs-body|contains: 'action=wdpsso_step2'
  condition: selection_uri and 1 of selection_action_*
falsepositives:
  - Legitimate WPMU DEV Hub SSO logins by site administrators
level: medium
---
title: WPMU DEV Hub SSO Brute Force Pattern (CVE-2026-76581)
id: 8c1d4e67-2a9f-4b38-c5d2-7f3a1e9b0462
status: experimental
description: Detects high-volume requests to WPMU DEV Hub SSO AJAX endpoints from a single source, consistent with HMAC boundary-collision fuzzing against CVE-2026-76581.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76581
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains: 'admin-ajax.php'
    cs-body|contains: 'wdpsso_step'
  condition: selection | count(c-ip) by cs-body > 20
  timeframe: 5m
falsepositives:
  - Load balancer health checks (should not hit these actions)
level: high
---
title: WordPress Admin SSO Login From Untrusted Source
id: 5b2e7a14-6c3d-4f19-a8e7-1d4c9b3f5028
status: experimental
description: Detects successful admin-ajax SSO completion followed by administrator session establishment from an external IP, a post-exploitation indicator for CVE-2026-76581.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76581
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1078
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains:
      - 'admin-ajax.php'
      - 'wp-login.php'
    cs-body|contains: 'wdpsso'
    sc-status:
      - 200
      - 302
  condition: selection
falsepositives:
  - Legitimate administrator Hub SSO logins — correlate against known admin source IPs
level: medium

Tuning note: These rules assume web server logs (IIS/Apache/Nginx) are ingested into your SIEM with request body capture enabled for admin-ajax.php. If body logging is not feasible, alert on URI + POST method volume anomalies to admin-ajax.php instead — coarser, but still valuable. Baseline legitimate Hub SSO traffic from your admins before raising severity.

KQL (Microsoft Sentinel / Defender)

Hunt for requests to the vulnerable SSO actions and post-exploitation admin activity. Assumes web logs ingested via CommonSecurityLog (CEF/Syslog from a WAF or reverse proxy) or a custom log table.

// Hunt: WPMU DEV Hub SSO endpoint access — CVE-2026-76581
// Requires WAF/reverse proxy logs with request body or query capture
let Lookback = 14d;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where RequestURL has "admin-ajax.php"
| where RequestURL has_any ("wdpsso_step1", "wdpsso_step2")
   or AdditionalExtensions has "wdpsso_step"
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            RequestCount = count(), DistinctURIs = dcount(RequestURL)
  by SourceIP, RequestURL, DestinationHostName
| where RequestCount > 10 or DistinctURIs > 1
| sort by RequestCount desc;

// Correlate: SSO endpoint hits followed by admin activity from same source IP
let SSO_Sources =
    CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where RequestURL has "admin-ajax.php" and RequestURL has "wdpsso_step"
    | summarize by SourceIP;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where SourceIP in (SSO_Sources)
| where RequestURL has_any ("plugin-install", "theme-editor", "update-core",
                            "user-new", "options.php", "plugin-editor")
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, RequestMethod
| sort by TimeGenerated asc;

Velociraptor VQL

If you suspect a site was compromised, hunt the underlying web server for web shells dropped into WordPress directories — the most common follow-on action after an admin-level auth bypass.

-- Hunt for recently modified PHP files in WordPress directories (web shell triage)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/var/www/*/wp-content/uploads/**/*.php',
  '/var/www/*/wp-content/themes/**/*.php',
  '/var/www/*/wp-content/plugins/**/*.php',
  '/var/www/*/wp-includes/*.php',
  '/var/www/html/wp-content/uploads/**/*.php'
])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

-- Identify PHP files containing common web shell signatures
SELECT FullPath, Size, Mtime
FROM glob(globs=['/var/www/**/*.php'])
WHERE Mtime > now() - 1209600
  AND Size < 50000
  AND content(path=FullPath) =~ 'eval\(|base64_decode|gzinflate|shell_exec|passthru|assert\('
ORDER BY Mtime DESC

Remediation

1. Patch Immediately (Primary Action)

Update the WPMU DEV Dashboard plugin to the latest available release beyond 5.0.1 via **WordPress Admin → Dashboard → Updates**, WP-CLI, or the WPMU DEV Hub itself. Verify the running version post-update — auto-update failures on managed fleets are common.

2. Verify and Disable Hub SSO as a Compensating Control

If you cannot patch immediately, disable Hub SSO site-wide. This removes the exploitation prerequisite while preserving the plugin's other management functions. In the WPMU DEV Dashboard plugin settings, toggle off Hub SSO, or revoke the Hub connection entirely for high-risk sites until patched.

3. Remediation & Verification Script

Run the following on your web servers (assumes WP-CLI installed and standard WordPress paths — adjust paths for your environment):

#!/bin/bash
# CVE-2026-76581 — WPMU DEV Dashboard plugin patch & verification script
# Run as a user with WP-CLI access to the WordPress installation

WP_PATH="/var/www/html"   # Adjust to your document root

# 1. Report current WPMU DEV Dashboard plugin version
echo "[+] Checking installed WPMU DEV Dashboard version..."
wp plugin list --path="$WP_PATH" --fields=name,version,status | grep -i wpmudev

# 2. Update the plugin to the latest release
echo "[+] Updating WPMU DEV Dashboard plugin..."
wp plugin update wpmudev-updates --path="$WP_PATH"

# 3. Verify patched version (must be > 5.0.1)
VER=$(wp plugin get wpmudev-updates --path="$WP_PATH" --field=version 2>/dev/null)
echo "[+] Installed version: $VER"
if [[ "$VER" == "5.0.1" || "$VER" < "5.0.2" ]]; then
  echo "[!] WARNING: Plugin still vulnerable. Disable Hub SSO immediately."
fi

# 4. Audit: list administrator accounts — look for unfamiliar users created recently
echo "[+] Auditing administrator accounts..."
wp user list --role=administrator --path="$WP_PATH" \
  --fields=ID,user_login,user_email,user_registered

# 5. Hunt web access logs for exploitation attempts
echo "[+] Scanning access logs for wdpsso endpoint hits..."
grep -hE "wdpsso_step[12]" /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null \
  | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

# 6. Find recently modified PHP files (potential web shells, last 14 days)
echo "[+] Checking for recently modified PHP files in wp-content..."
find "$WP_PATH/wp-content" -name "*.php" -mtime -14 -type f | head -50

echo "[+] Done. Investigate any unfamiliar admin users or unexpected wdpsso source IPs."

4. Post-Incident Verification

If your logs show wdpsso_step2 requests from external IPs before you patched, assume compromise:

• Force password resets for all administrator accounts and invalidate all sessions (rotate salts/keys in wp-config.php — AUTH_KEY, SECURE_AUTH_KEY, etc. — to kill existing cookies).
• Audit user accounts for unauthorized administrators or subscribers with elevated roles.
• Diff plugins and themes against known-good sources (wp plugin verify-checksums for core; reinstall plugins/themes from clean sources if any doubt).
• Review wp-config.php, functions.php, and mu-plugins/ for injected code — a favorite persistence location.
• Check outbound connections from the web server for C2 or data exfiltration.
• Rotate the WPMU DEV Hub API credentials and any secrets accessible from the WordPress configuration.

5. Architectural Hardening (Longer Term)

• IP-restrict /wp-admin/ and admin-ajax.php SSO actions at the WAF or reverse proxy where feasible — Hub SSO callbacks from known WPMU DEV infrastructure can be allow-listed, and everything else challenged.
• Deploy a WAF rule blocking requests containing wdpsso_step1/wdpsso_step2 from untrusted sources until patching is complete.
• Enforce MFA on all WordPress administrator accounts — it does not stop this bypass during SSO flow manipulation, but it limits the value of hijacked or replayed credentials in adjacent attack paths.
• Enable comprehensive request-body logging for admin-ajax.php on production WordPress fleets. You cannot hunt what you cannot see.
• Inventory your plugin estate. Every managed WordPress site should have a plugin bill of materials so advisories like CVE-2026-76581 can be scoped in minutes, not days.

The Bigger Lesson

CVE-2026-76581 is a case study in two recurring cryptographic implementation failures: non-canonical message construction (unseparated concatenation of variable-length fields) and sign/verify asymmetry (signing one message shape and verifying another). Both are well-understood anti-patterns — HMAC inputs should be length-prefixed, delimited, or serialized canonically, and the exact byte sequence signed must be the exact byte sequence verified.

For defenders, the operational takeaway is simpler: unauthenticated SSO helper endpoints on internet-facing CMS platforms are high-value targets, and plugin auth bypasses in the WordPress ecosystem move from disclosure to mass exploitation fast. Patch now, verify your exposure prerequisites, hunt your logs, and treat any pre-patch hits as a compromise until proven otherwise.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub