CVE-2026-76581 is a critical authentication bypass vulnerability in the WPMU DEV Dashboard WordPress plugin. The flaw is a canonicalization weakness in the plugin's Hub Single Sign-On (SSO) authentication process: the plugin constructs its HMAC-SHA-256 signature differently at two separate stages, once over a token, hashed state, redirect URL and domain concatenated without delimiters, and once verified using only the token, state and redirect fields, omitting the domain entirely.

This inconsistency lets an unauthenticated attacker forge a valid signature for the second verification stage by rearranging values from the first, without ever needing a valid API key or credentials. If the Hub SSO account the forged session maps to holds administrator privileges, the attacker gains complete control of the WordPress installation.

The following version(s) are affected:

•    WPMU DEV Dashboard 5.0.1 and earlier - (Affected)

WPMU DEV Dashboard 5.0.2 and later - (Not affected, patched)

The fix, released 24 August 2026, stores the stage-one HMAC signature server-side and rejects any replayed signature presented at stage two. Site administrators should confirm their installed plugin version from the WordPress admin dashboard.

Typical attack flow:

1.    Initiate the SSO handshake with an empty redirect
o    The attacker starts the Hub SSO stage-one process with an empty redirect parameter, obtaining a valid signature that in fact covers the token, state, and domain values.
2.    Replay the signature to forge stage two
o    The attacker places the domain value into the redirect field when calling stage two, causing the token/state/redirect combination checked there to match the forged signature from stage one, and the request validates as legitimate.

Attack vectors:
•    Remote, unauthenticated network requests directly against the site's Hub SSO endpoint - no API key or credentials required.
•    Any WordPress site with WPMU DEV Dashboard installed and Hub SSO enabled.

Successful exploitation may allow attackers to:
•    Create a valid, authenticated WordPress session mapped to a Hub SSO account without any credentials.
•    Gain complete control of the WordPress installation if that account holds administrator privileges — installing plugins, modifying themes, stealing credentials, or achieving remote code execution.

CERTVU recommends the following:

1. Update WPMU DEV Dashboard immediately
•    Upgrade to WPMU DEV Dashboard 5.0.2 or later without delay.

2. Audit Hub SSO account mappings
3. Review WordPress admin accounts
4. Audit the estate for the affected product
5. Monitor WPMU DEV's and Wordfence's security advisories for further updates

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.