CVE-2026-76581: CWE-347 Improper Verification of Cryptographic Signature in wpmudev WPMU DEV Dashboard

CVE-2026-76581 is an authentication bypass vulnerability in the WPMU DEV Dashboard plugin for WordPress. The issue stems from inconsistent and ambiguous construction of HMAC messages between the unauthenticated AJAX actions `wdpsso_step1` and `wdpsso_step2`. Specifically, step 1 signs and discloses a concatenation of token, state, redirect, and domain values without separators, while step 2 verifies a concatenation that omits the domain field. This discrepancy allows unauthenticated attackers to obtain a valid HMAC from step 1 and replay it in step 2 by shifting the domain value into the redirect field, resulting in an authenticated administrator session on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator.

Successful exploitation allows unauthenticated attackers to bypass authentication and gain administrator-level access to affected WordPress sites using the WPMU DEV Dashboard plugin with Hub SSO enabled. This leads to full control over the site, including confidentiality, integrity, and availability impacts rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, sites using WPMU DEV Dashboard with Hub SSO enabled should consider disabling the plugin or the Hub SSO feature to mitigate risk.