CVE-2026-103646: CWE-287 Improper Authentication in Ultimate Multisite
Description
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
CVSS v3.1
Score 9.8critical
Affected software
Ultimate Multisite
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-103646 is an improper authentication vulnerability (CWE-287) in the Ultimate Multisite WordPress plugin versions prior to 2.17.0. The plugin does not require authentication before linking a logged-out checkout to an existing WordPress account matching the submitted email address. The duplicate-account check normalizes email addresses differently from the lookup used to create the customer, enabling an attacker to bypass authentication and log in as any user whose email they know. This includes high-privilege accounts such as Network Super Admins. The vulnerability is not mitigated by the earlier fix for CVE-2026-75957 and affects all versions up to and including 2.16.1. Exploitation requires a checkout form without a password field (auto-generated password) and a target account lacking an existing customer record in the plugin.
Potential Impact
An unauthenticated attacker can gain unauthorized access to any existing user account, including high-privilege Network Super Admin accounts, by exploiting email normalization inconsistencies. This can lead to full account takeover without needing valid credentials, posing a significant security risk to affected WordPress sites using the vulnerable plugin versions.
Mitigation Recommendations
Upgrade the Ultimate Multisite WordPress plugin to version 2.17.0 or later, where this authentication bypass vulnerability is fixed. Versions prior to 2.17.0 remain vulnerable despite previous patches. No other mitigations are indicated in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-01T06:42:15.491Z
- State
- PUBLISHED
Threat ID: 6ac735da2cdf04f656f03e9d
Added to database: 10/08/2026, 06:19:06 UTC
Last enriched: 10/08/2026, 06:34:31 UTC
Last updated: 10/08/2026, 18:48:43 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.