A critical security vulnerability has been discovered in the WPMU DEV Dashboard plugin, a widely used tool with an estimated 350,000 active installations that connects WordPress sites to WPMU DEV services. The vulnerability allows unauthenticated attackers to gain administrator access to affected sites when Hub Single Sign-On (SSO) is enabled, potentially leading to complete site takeover and remote code execution.
At BG Cyber Connect, we take proactive security seriously. Here is what you need to know about this vulnerability and the steps you must take to protect your website.
The vulnerability was discovered by Wordfence’s internal research team, Wordfence Argus, on August 19, 2026, during routine security research. It affects all versions of WPMU DEV Dashboard up to and including version 5.0.1.
WPMU DEV Dashboard implements a Hub SSO flow through two AJAX actions: wdpsso_step1 and wdpsso_step2. Both actions are accessible by unauthenticated visitors, which is necessary for the SSO flow since the visitor is not yet authenticated when the exchange begins.
The vulnerability arises from a critical flaw in how these two steps handle cryptographic signatures:
This creates an ambiguity between the two signed messages. Because the fields are concatenated without unambiguous boundaries, an unauthenticated attacker can exploit this inconsistency.
An attacker can request step 1 with an empty redirect value. Step 1 then signs token || state || domain. The attacker can replay that same HMAC to step 2 while placing the returned domain in the step-2 redirect field. Since step 2 also constructs token || state || domain, the two byte strings are identical even though the domain occupies a different logical field.
The attacker does not need to know the WPMU DEV API key. Step 1 effectively acts as a signing oracle, returning a valid HMAC that step 2 accepts for a different interpretation of the same concatenated bytes.
Once the checks pass, the plugin creates an authentication cookie for the WordPress user configured for Hub SSO. On sites where SSO is mapped to an administrator, the unauthenticated attacker receives an administrator session—granting complete control of the WordPress site.
Your site is vulnerable if:
Important note: This vulnerability is distinct from an earlier WPMU DEV Dashboard authentication bypass that affected versions up to and including 5.0.0. That earlier issue involved empty-key WDP-AUTH validation and affected unconnected sites through the Hub remote-request path. This new vulnerability affects connected sites with Hub SSO enabled and remains exploitable in version 5.0.1 despite the protections added for the earlier issue.
The WPMU DEV team responded promptly to the disclosure. After receiving full disclosure details on August 19, 2026, the developer acknowledged the report and submitted a pre-release patch for review on August 21. The patch was released to the public as version 5.0.2 on August 24, 2026.
The vendor’s patch stores the HMAC created during step 1 in a server-side SSO setting. Step 2 then validates that this stored value has the expected format and rejects the request when the incoming signature is the same signature produced by step 1. A successful legitimate SSO exchange clears the temporary value.
Wordfence tested the reported attack against the patched build and confirmed that replaying the step-1 HMAC in step 2 was rejected without creating a login cookie, while legitimate SSO flows continued to work correctly.
The single most critical action is to update WPMU DEV Dashboard to version 5.0.2 or later.
To update:
Sites that cannot update immediately should disable Hub SSO until the patched version has been installed.
Wordfence Premium, Care, and Response customers received a firewall rule protecting against known exploitation techniques on August 25, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later, on September 24, 2026.
If you use Wordfence, ensure your firewall is active and your rules are up to date. If you use a different security solution, verify that it provides equivalent protection.
If your site was running a vulnerable version with Hub SSO enabled, we strongly recommend reviewing your site for signs of unauthorised access, including:
At BG Cyber Connect, we understand that keeping your WordPress site secure requires constant vigilance. Our team can:
We have previously covered several critical WordPress vulnerabilities, including the UpdraftPlus authentication bypass, the All-in-One WP Migration SQL injection, and the Elementor Pro unauthenticated file upload.
For a complete technical analysis of this vulnerability, read Wordfence’s detailed breakdown:
Update WPMU DEV Dashboard to version 5.0.2 now. This vulnerability allows unauthenticated attackers to gain administrator access on sites with Hub SSO enabled. The patch is available, and the risk of exploitation is significant.
Need Help Securing Your WordPress Site?
Contact BG Cyber Connect for an Immediate Security Assessment
Explore our comprehensive WordPress security services:
BGCC Cybersecurity Solutions
Is your business truly secure? This free IT setup assessment questionnaire helps you identify strengths and gaps in your cybersecurity and IT environment. Covering account security, phishing awareness, device protection, backup recovery, infrastructure, and overall security review. Answer Yes, No, or Unsure and schedule a consultation with BG Cyber Connections or your current IT Service Provider.
The Elementor team has released a critical security update addressing a CSRF vulnerability in Elementor versions 4.3.0 and 4.3.1. The flaw could have allowed attackers to perform unauthorized actions on affected sites. Patched in version 4.3.2 (released September 25, 2026). Update immediately to protect your WordPress site.
A critical unauthenticated file upload vulnerability in the WooCommerce Wholesale Lead Capture plugin is being actively exploited, with over 100,000 attack attempts blocked. The flaw allows attackers to upload PHP backdoors and achieve remote code execution. Patched version 2.0.3.2 is available. Update immediately.
Book Now!
