Executive brief
The WPMU DEV Dashboard plugin is a WordPress site management tool that integrates with the WPMU DEV Hub for remote administration. An authentication bypass vulnerability in versions up to 5.0.1 allows unauthenticated attackers to gain administrator access on vulnerable sites by exploiting a flawed SSO handshake mechanism. This could result in complete site compromise, data theft, and unauthorized administrative control.
Technical details
The vulnerability stems from inconsistent HMAC message construction in the SSO authentication flow. The unauthenticated `wdpsso_step1` AJAX action signs an unseparated concatenation of token, state, redirect, and domain values, while `wdpsso_step2` verifies an unseparated concatenation that omits the domain field. An attacker can obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, bypassing authentication. This affects all versions up to and including 5.0.1 and requires the target site to be connected to WPMU DEV Hub with SSO enabled and mapped to an administrator account. The attack is network-accessible and requires no user interaction.
Affected products
- WPMU DEV Dashboard up to and including 5.0.1
Timeline
- 2026-08-28: disclosed