CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Called exploited 1 days before disclosure.
Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.
The life of this vulnerability
- CVE published
- First KEV listing1d
- Last sighting4d
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federaldoes not list it
- EUVDENISA, European Uniondoes not list it
- VulnCheck KEVcommercial researchlisted Aug 27, 2026
- CIRCLaggregator, mirrors the abovedoes not list it
This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.
Public exploitation evidence
- reported exploitationpatchstack.com/database/wordpress/plugin/wpmudev-updates/vul
- reported exploitationwww.wordfence.com/threat-intel/vulnerabilities/wordpress-plu
2 public reports collected from VulnCheck and CIRCL, first on Aug 27, 2026. Each links to its original source. We have not verified them.
Description
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the red
