Reported by 3 outlets

Timeline

1. original reporting

   Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

   malware.news · 47d ago · August 27th, 2026

   On August 19th, 2026, during internal research, I discovered an Authentication Bypass vulnerability in WPMU DEV Dashboard , a WordPress plugin with an estimated 350,000 active installations. This vulnerability makes it possible for unauthenticated attackers to gain administrator access when Hub Single-Sign On is enabled. This can lead to complete site takeover and, when an administrator-accessible code-write mechanism such as the WordPress plugin or theme editor is available, remote code execution. I discovered this vulnerability with the help of Wordfence Argus , which we covered in a separate post . Our mission is to secure WordPress through defense in depth, which is why we invest in quality vulnerability research and work closely with plugin vendors to ensure vulnerabilities are addressed before they can be widely exploited. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element of a multi-layered approach to security. We provided full disclosure details to the WPMU DEV team through our Wordfence Vulnerability Management Portal on the same day of discovery, August 19, 2026. The developer acknowledged the re

2. update from cyberpress.org

   Critical WPMU DEV Dashboard Flaw Can Lead to WordPress Remote Code Execution

   cyberpress.org · 46d ago · August 28th, 2026

   A critical authentication bypass vulnerability in the WPMU DEV Dashboard plugin could allow unauthenticated attackers to obtain administrator access to vulnerable WordPress sites and potentially execute arbitrary code. Tracked as CVE-2026-76581 , the flaw has a CVSS score of 9.8 and affects WPMU DEV Dashboard versions 5.0.1 and earlier. The plugin, used on an estimated 350,000 WordPress sites, has been patched in version 5.0.2. The vulnerability was discovered by Wordfence researcher Alex Thomas on August 19 during internal research aided by the company’s Argus vulnerability-discovery system. Critical WPMU DEV Dashboard Flaw Exploitation requires the target WordPress site to be connected to WPMU DEV, have Hub Single Sign-On enabled, and map the Hub SSO account to a WordPress administrator. The issue stems from inconsistent HMAC message construction across two unauthenticated AJAX actions used by the plugin’s Hub SSO workflow , wdpsso_step1 and wdpsso_step2 . Both endpoints must be accessible before a visitor logs in to WordPress. However, their cryptographic validation logic did not consistently bind individual fields to their intended meaning. Wordfence firewall stop exploitation (Source: Wordfence) During the first SSO step, the plugin generated an HMAC-SHA256 signature by concatenating a token, hashed state value, redirect parameter, and site domain without delimiters or length prefixes.

3. update from gbhackers.com

   Critical WordPress Plugin Flaw Allows Unauthenticated Administrator Account Takeover

   gbhackers.com · 46d ago · August 28th, 2026

   The plugin […] The post Critical WordPress Plugin Flaw Allows Unauthenticated Administrator Account Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .