Ultimate Multisite Wordpress Multisite Saas Waas Platform
Monthly
Unauthenticated attackers can obtain full WordPress session cookies - including for a Network Super Admin - on any Multisite installation running the Ultimate Multisite (WaaS/SaaS) plugin through version 2.15.0. The flaw lies in the publicly reachable wu_ajax_nopriv_wu_validate_form AJAX handler: supplying checkout_form=wu-finish-checkout discards all validation rules and forces is_last_step() to true, routing the request straight into order processing, where the attacker-supplied email_address is resolved to an existing WordPress user ID without ownership verification and login_customer_after_checkout() issues a passwordless wp_set_auth_cookie() for that user. Exploitation requires only a freely obtainable checkout nonce and the victim's email address (remote, unauthenticated, no user interaction per the CVSS vector PR:N/UI:N), but it succeeds only against accounts that have no pre-existing Ultimate Multisite customer record - such as a Network Super Admin on a fresh Multisite install or any administrator/editor created before the plugin was configured. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, though the 9.8 score and authentication-bypass-to-admin impact make this a high-priority patch.
Unauthenticated attackers can obtain full WordPress session cookies - including for a Network Super Admin - on any Multisite installation running the Ultimate Multisite (WaaS/SaaS) plugin through version 2.15.0. The flaw lies in the publicly reachable wu_ajax_nopriv_wu_validate_form AJAX handler: supplying checkout_form=wu-finish-checkout discards all validation rules and forces is_last_step() to true, routing the request straight into order processing, where the attacker-supplied email_address is resolved to an existing WordPress user ID without ownership verification and login_customer_after_checkout() issues a passwordless wp_set_auth_cookie() for that user. Exploitation requires only a freely obtainable checkout nonce and the victim's email address (remote, unauthenticated, no user interaction per the CVSS vector PR:N/UI:N), but it succeeds only against accounts that have no pre-existing Ultimate Multisite customer record - such as a Network Super Admin on a fresh Multisite install or any administrator/editor created before the plugin was configured. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, though the 9.8 score and authentication-bypass-to-admin impact make this a high-priority patch.