WPMU DEV Dashboard CVE-2026-76581

Exploitation requires the target WordPress site to be connected to WPMU DEV with the Hub SSO feature enabled and the SSO mapping pointed at an administrator account - this is the exact precondition stated in the description and is the primary factor limiting exploitation. Given the confirmed CVSS vector (PR:N/UI:N), no authentication and no user interaction are needed once that configuration is present: the attacker directly calls the unauthenticated wdpsso_step1 and wdpsso_step2 AJAX actions. Sites that have not enabled Hub SSO, are not connected to the Hub, or map SSO to a non-administrator are not exploitable, so this is not a default-configuration flaw despite the network-facing, unauthenticated attack surface.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8 Critical) indicates remote, unauthenticated, low-complexity exploitation with full compromise - consistent with an authentication bypass that yields an administrator session. No EPSS score, KEV entry, SSVC decision, or public POC was provided, so predicted exploitation probability is unknown and there is no evidence of active exploitation; the finding is a Wordfence threat-intel disclosure. The most important qualifier is that CVSS does not capture the deployment precondition: exploitation only works on sites actively connected to WPMU DEV with Hub SSO enabled and mapped to an administrator. This means the raw 9.8 overstates blanket risk - real risk is high specifically for that configured subset and materially lower for sites not using Hub SSO. Net: treat as a genuine critical for affected configurations, but scope exposure by checking whether Hub SSO is enabled before triaging site-wide panic.

An attacker targeting a WordPress site that uses WPMU DEV Hub SSO calls the unauthenticated wdpsso_step1 AJAX action to obtain a validly HMAC-signed token that discloses the token, state, redirect, and domain values. They then replay that signature to wdpsso_step2 with the domain value moved into the redirect field, satisfying the verifier's three-field concatenation and receiving an authenticated administrator session. No public POC is noted, but low attack complexity and no authentication requirement make weaponization straightforward once the message-construction quirk is understood.