Ultimate Multisite CVE-2026-103646

Exploitation requires BOTH: (1) the Ultimate Multisite checkout form configured WITHOUT a password field, i.e. using auto-generated passwords, and (2) a target account (e.g. a Network Super Admin) that has NO existing customer record in the plugin. The attacker must also know the target's exact email address. The core flaw is that the duplicate-account check normalizes the submitted email differently from the lookup used to create the customer, so a logged-out checkout links to and authenticates as the matching existing WordPress account without any authentication. LIMITING FACTORS: sites using password-protected checkout are not affected; targets who already have a plugin customer record are not exploitable; and the bug exists specifically in versions up to and including 2.16.1 and is NOT fixed by the 2.15.1 patch for CVE-2026-75957 - only 2.17.0 resolves it.

Multiple signals point to genuine high priority, with some caveats. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a fully remote, unauthenticated authentication bypass (CWE-287) that yields complete account takeover - including the Network Super Admin - which in a WordPress multisite is effectively total compromise of the whole network. A vendor patch (2.17.0) is confirmed available and the issue was reported by a credible researcher source (WPScan). However, several escalating signals are MISSING from the input: no EPSS probability is provided, there is no CISA KEV listing, and no public proof-of-concept is indicated, so exploitation status is 'no public exploit identified at time of analysis.' There is also a notable tension between the raw 9.8 score and the stated exploitation conditions: the description explicitly requires a non-default deployment (a checkout form configured WITHOUT a password field, i.e. auto-generated passwords) AND a target account that has no existing customer record in the plugin. These are prerequisites outside the attacker's control, which argues the real-world AC:L in the input understates attack complexity - this is why my independent assessment lowers it to AC:H. Net: treat as a high-urgency patch for any site actually running the affected plugin in the vulnerable configuration, but recognize that environments using password-protected checkout, or where admins already have customer records, are not exploitable. This is a real priority where the preconditions are met, not a blanket 9.8-everywhere emergency.

An unauthenticated attacker who knows the email address of a Network Super Admin (often discoverable from author pages, WHOIS, or public posts) submits a logged-out checkout on a site whose checkout form is configured for auto-generated passwords (no password field). Because the plugin's duplicate-account check normalizes the email differently than the lookup used to create the customer, the flow links to and logs the attacker in as that existing WordPress account. No public exploit code is identified at time of analysis, but the technique is fully described in the WPScan advisory.