Ultimate Multisite EUVD-2026-90546

Exploitation targets the publicly accessible wu_ajax_nopriv_wu_validate_form AJAX handler of the Ultimate Multisite plugin (versions ≤2.15.0) using checkout_form=wu-finish-checkout, which forces is_last_step() true and drives the request into full order processing and the passwordless login_customer_after_checkout() path. The attacker needs only a freely obtainable checkout nonce and the victim's email address - no authentication, no user interaction. The key LIMITING factor is that the targeted account must have NO pre-existing Ultimate Multisite customer record; this means the attack works against the Network Super Admin on a fresh Multisite install and against any administrator or editor account created before Ultimate Multisite was configured, but not against users already registered as plugin customers. The plugin must be installed and active on a WordPress Multisite (SaaS/WaaS) environment with the checkout flow reachable.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk inflation. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is credible and consistent with the description: an unauthenticated, remote, network-reachable authentication bypass that yields a full login session as any existing WordPress user - including a Network Super Admin - which is effectively complete account takeover (C:H/I:H/A:H). The only moderating condition is that the targeted account must have no pre-existing Ultimate Multisite customer record; however, the description explicitly notes that the Super Admin on a fresh Multisite and any admin/editor created before the plugin was configured satisfy this, so in practice the highest-value accounts are usually exploitable. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so there is no public exploit identified at time of analysis and no confirmed active exploitation - but the trivial preconditions (attacker needs only a freely obtainable checkout nonce plus the victim's email address) mean weaponization is low-effort and defenders should treat patching as urgent rather than waiting for exploitation signals. In short: the real-world risk is high despite the absence of exploitation telemetry, driven by low attack complexity and super-admin-level impact.

An unauthenticated attacker loads the plugin's public checkout page to harvest the freely-available checkout nonce, then sends a crafted wu_ajax_nopriv_wu_validate_form AJAX request with checkout_form=wu-finish-checkout and the email_address of a target WordPress user (e.g. the Network Super Admin). The validation and step logic collapse so the request is routed straight into order finalization, maybe_create_customer() resolves the email to the existing user ID, and login_customer_after_checkout() issues a valid auth cookie for that account - granting the attacker a logged-in super-admin session. No public exploit code was provided in the input, but the attack requires no authentication and only trivially obtainable inputs.