CVE-2026-76581Patch

HIGHCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 5 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts

Recommended action window: Immediate (within 24h)

NVD description

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.

Back to dashboard

6.3/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-347

Priority

HIGH

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Exploit tooling references are present in monitored signal
Patch or workaround signal is available
15 mentions across 9 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
Patch or workaround mentioned in 8 signals
Technical details provided in 12 signals
Disclosure: 4 classified signals
Peaked 6d ago at 5 mentions (2026-08-29); latest day: 1
15 total mentions across 9 days

Deep dive

Activity timeline15 mentions / 9d

Signal classification5 categories

Patch

853.3%

Disclosure

426.7%

Exploit

16.7%

General

16.7%

Active Exploitation

16.7%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-27	1	Patch1
2026-08-28	1	Patch1
2026-08-29	5	Disclosure2Patch3
2026-08-30	3	Disclosure1Exploit1Patch1
2026-08-31	1	Disclosure1
2026-09-01	1	Patch1
2026-09-02	1	General1
2026-09-03	1	Active Exploitation1
2026-09-04	1	Patch1

Full discourse15 posts

Rıdvan Yağlı@ridvanyagli44d
Patch
🚨 WordPress'te WPMU DEV Dashboard eklentisinde CVE-2026-76581 numaralı ve CVSS 9.8 skorlu kritik Authentication Bypass açığı keşfedildi. Bu açık, Hub SSO'nun HMAC doğrulamasındaki canonicalization hatasından yararlanıyor. Kimlik doğrulaması gerektirmeyen saldırgan, HMAC'i farklı bir SSO adımında yeniden kullanarak yönetici oturumu elde edebiliyor. ➡️ 5.0.2+ sürümüne güncelleyin. https://www.wordfence.com/blog/2026/08/wordfence-argus-finds-critical-authentication-bypass-in-wpmu-dev-dashboard-plugin/
Post summary
A critical authentication bypass vulnerability (CVE‑2026‑76581) was identified in WPMU DEV Dashboard, and users are advised to update to version 5.0.2 or newer for remediation.
00032490
2.4K followersView on X
!Manan@0xManan44d
Patch
CVE-2026-76581 is canonicalization, not crypto breakage. wdpsso_step1 signs token||state||redirect||domain. wdpsso_step2 verifies token||state||redirect. no delimiters, no lengths. call step1 with redirect="". server signs token||state||domain and hands you the HMAC. replay it in step2 with domain moved into redirect. same byte string, different field meaning. step2 accepts it. you never touch the WPMU DEV API key. step1 is just a signing oracle. if hub SSO is mapped to an admin you get wordpress_logged_in. 350k installs sounds scary. the actual gate is hub SSO enabled + admin mapping. still ugly. patch in 5.0.2 stores the step1 HMAC server-side and rejects replay. https://nvd.nist.gov/vuln/detail/CVE-2026-76581
Post summary
The post explains a canonicalization flaw in WPMU DEV SSO that allows replaying HMACs to elevate privileges, and it notes that version 5.0.2 includes a patch that mitigates the issue.
00020285
2.2K followersView on X
iototsecnews@iototsecnews39d
Patch
WordPress WPMU DEV プラグインの脆弱性 CVE-2026-76581 が FIX：管理者権限奪取の恐れ https://iototsecnews.jp/2026/08/28/critical-wordpress-plugin-flaw-allows-unauthenticated-administrator-account-takeover/ WordPress の管理プラットフォーム連携機能における認証処理の不備を紹介する記事です。この問題は、WPMU DEV Dashboard プラグインの内部で HMAC 署名を生成／検証する際のデータ構造の不一致が原因で発生します。未認証の第三者による署名検証の迂回／管理者セッションの奪取／ Web サイトの完全な奪取といった深刻な影響を及ぼします。脆弱性 CVE-2026-76581 への対策として、安全なバージョン 5.0.2 以降への迅速な更新、または一時的な Hub SSO 機能の無効化が求められます。 #CVE202676581 #Vulnerability #WordPress #WPMUDEVDashboard
Post summary
The article discloses a critical WordPress plugin flaw that permits unauthenticated attackers to take over admin sessions, and recommends updating to v5.0.2 or disabling Hub SSO to mitigate the risk.
00010106
513 followersView on X
mohamedation@mohamedation39d
Active Exploitation
how do you go though access.log to track an incident or a timeline of events? this is an example of CVE-2026-15981 & CVE-2026-76581 attack taking place https://t.co/xlAnxkFLdl
Post summary
The post cites ongoing attacks against CVE‑2026‑15981 and CVE‑2026‑76581 with no technical or mitigation details, indicating only that these CVEs are being actively exploited.
0001036
330 followersView on X
WP Security Ninja@WPSecurityNinja41d
Patch
Hub SSO mapped to an admin on WPMU DEV Dashboard? Update to 5.0.2. CVE-2026-76581, CVSS 9.8, through 5.0.1. A signature mismatch can mint an admin session. Cannot patch today? Disable Hub SSO, then check unexpected admin logins. https://github.com/advisories/GHSA-2cxw-5886-mfv5 #WordPress
Post summary
The advisory highlights CVE‑2026‑76581, where a signature mismatch can elevate a user to an admin session. A patch is not yet available, so the recommended mitigation is to disable Hub SSO and monitor for unexpected admin logins.
0001067
354 followersView on X
itsalreadywhen@itsalreadywhen43d
Exploit
Microsoft details TerminalFix, a ClickFix variant abusing Windows Terminal, while five critical WordPress flaws (including CVE-2026-76581) open the door to site takeover and RCE. #CyberSecurity #BlueTeam https://t.co/4u68PzRkmK
Post summary
The tweet outlines Microsoft’s TerminalFix variant and severe WordPress flaws that enable remote code execution and site takeover, though it provides no PoC, patch, or evidence of active exploitation.
1000053
6 followersView on X
LoreleiWeb@LoreleiWeb44d
Disclosure
🆕👉 WPMU DEV Dashboard https://wpdeeply.com/wpmu-dev-dashboard-5-0-1-authentication-bypass-hub-sso-hmac-confusion/ #loreleiweb Wordfence published CVE-2026-76581 on August 27, 2026 for WPMU DEV Dashboard, a WordPress plugin used to connect sites to WPMU DEV services. Wordfence estimates 350,000 active installations. The vulnerability allows … https://t.co/NfwrIlE1Cm
Post summary
Wordfence released CVE‑2026‑76581 for the WPMU DEV Dashboard plugin, highlighting a potential authentication bypass, but the post does not provide a PoC, exploit, or patch information.
00010283
85.9K followersView on X
DFIR Radar@DFIR_Radar46d
Patch
CVE-2026-76581 (CVSS 9.8): Unauthenticated auth bypass in WPMU DEV Dashboard lets attackers claim an admin session on ~350,000 WordPress sites via HMAC canonicalization confusion in the Hub SSO flow. Patch to 5.0.2 now. Key findings: - CVE-2026-76581, CVSS 9.8 Critical. Affects WPMU DEV Dashboard versions up to and including 5.0.1 on sites with Hub SSO enabled and mapped to an administrator. Exploitation is unauthenticated and leads to full site takeover, and to RCE if the plugin or theme editor is accessible. - The root cause is HMAC canonicalization confusion between the two AJAX actions wdpsso_step1 and wdpsso_step2, both exposed to unauthenticated visitors. Step 1 signs token||state||redirect||domain without delimiters. Step 2 verifies token||state||redirect, omitting domain. An attacker calls step 1 with an empty redirect, receives a valid HMAC over token||state||domain, then replays it to step 2 with domain moved into the redirect field. The byte strings are identical so verification passes. Step 1 acts as a signing oracle. - The patch stores the step-1 HMAC server-side and explicitly rejects any step-2 submission where the incoming HMAC matches the stored step-1 value, breaking the replay. - Wordfence Premium, Care, and Response customers received a firewall rule August 25. Free users receive it September 24. Sites that cannot update immediately should disable Hub SSO. Update to 5.0.2 immediately. #DFIR_Radar
Post summary
The announcement details a critical authentication bypass in WPMU DEV Dashboard, explains how the exploit works, and provides immediate remediation steps including a patch to version 5.0.2.
10000203
1.9K followersView on X
mohamedation@mohamedation40d
General
so in reality, there is some mixing of CVE numbers floating around. CVE-2026-15981 is the miniOrange/SAML authentication bypass (the openssl_verify -1 treated as true bug). The WPMU DEV Dashboard issue that Wordfence wrote about is actually CVE-2026-76581
Post summary
The passage clarifies that CVE-2026-15981 is a miniOrange/SAML authentication bypass and that the WPMU DEV Dashboard issue corresponds to CVE-2026-76581, correcting earlier misidentification of the CVE numbers.
0000041
329 followersView on X
SecAlerts@SecAlertsCo42d
Disclosure
Vulns in WordPress plugins and themes. CVE-2026-82222, CVSS 10 - https://secalerts.co/vulnerability/CVE-2026-82222 CVE-2026-76581 - https://secalerts.co/vulnerability/CVE-2026-76581 CVE-2026-18431 - https://secalerts.co/vulnerability/CVE-2026-18431 CVE-2026-19632 - https://secalerts.co/vulnerability/CVE-2026-19632 CVE-2026-19598 - https://secalerts.co/vulnerability/CVE-2026-19598 #ciso #cio #cto #msp #mssp https://t.co/ILSfPKqogV
Post summary
The tweet announces multiple new WordPress CVEs, provides CVSS scores and links to detailed advisories.
00000166
885 followersView on X
YBE@Lumideezy43d
Patch
Prioritize patching for critical WordPress plugin/theme flaws (e.g., WPMU DEV Dashboard CVE-2026-76581, CVSS 9.8) that enable unauthenticated admin takeover or RCE. Audit installed components and apply updates immediately to prevent site compromise.
Post summary
The post emphasizes urgent patching of the high‑severity WPMU DEV Dashboard flaw (CVE‑2026‑76581) that allows unauthenticated admin takeover or RCE, providing vulnerability details but no exploit or active use evidence.
00000130
4.2K followersView on X
Security Arsenal, LLC@SecurityAr5840944d
Disclosure
🔒 #CyberSecurity Critical WordPress Plugin & Theme Flaws (CVE-2026-76581): Avada, GiveWP, Pods, … "Wordfence and Patchstack have disclosed a cluster of critical vulnerabilities affecting some…" 🔗 https://securityarsenal.com/blog/critical-wordpress-plugin-and-theme-flaws-cve-2026-76581-avada-givewp-pods-translatepress-wpmu-dev-dashboard-detection-and-remediation-guide #CyberSecurity #ThreatIntel #critical #zeroday #cve
Post summary
The post announces the discovery of critical WordPress plugin and theme vulnerabilities (CVE‑2026‑76581) disclosed by Wordfence and Patchstack, providing a link to a blog for further details and remediation guidance.
0000068
29 followersView on X
Dexmond Technologies Ltd@Dexmond_Tech44d
Patch
News: Five critical WordPress plugin and theme flaws disclosed — WPMU DEV Dashboard, Avada, TranslatePress, Pods and GiveWP — that can lead to authentication bypass, account takeover and arbitrary code execution. Wordfence and Patchstack flag CVE-2026-76581 (CVSS 9.8) among the high-impact issues. Immediate actions: patch or disable affected plugins and themes now. If a patch isn’t available, restrict admin endpoints by IP, enforce MFA, rotate credentials and keys, enable WAF virtual patches, and scan for webshells or privilege-escalation traces. Review logs and isolate any compromised instances. Enterprise guidance: maintain an authoritative plugin/theme inventory, prioritise internet-facing attack surfaces, enforce change-control for third-party components, run continuous vulnerability scanning and runtime protection, and ensure the incident response playbook includes CMS takeover scenarios. Treat these disclosures as high-priority supply-chain incidents. Dexmond recommends rapid remediation and layered controls to reduce exposure and speed recovery. #Dexmond #CyberSecurity #WordPress #Vulnerability #PatchNow
Post summary
The post lists five critical WordPress plugin and theme vulnerabilities (e.g., CVE-2026-76581) with a CVSS score of 9.8, and urges immediate patching, disabling affected components, and applying layered defenses to prevent authentication bypass, account takeover, and arbitrary code execution.
00000101
45 followersView on X
CyberNewsDaily@NewsDaily1857944d
Disclosure
🔴 CVE-2026-76581 (CVSS: 9.8/10) [EPSS: 0.3%] lets attackers bypass authentication in WordPress plugins like WPMU DEV, Avada, TranslatePress, Pods, and GiveWP. Sites can be hijacked or run code. via The Hacker News https://t.co/46Sev9Z3VD
Post summary
The post announces a high‑severity authentication bypass vulnerability (CVE‑2026‑76581) affecting several WordPress plugins, noting its CVSS score and potential impact, but it does not mention any PoC, exploit tool, or active exploitation.
0000047
22 followersView on X
CyberSignal | Cybersecurity News@XQOPTRX45d
Patch
🚨 CRITICAL WORDPRESS AUTH BYPASS — ATTACKERS CAN TURN AN UNAUTHENTICATED REQUEST INTO AN ADMIN SESSION CVE-2026-76581 affects WPMU DEV Dashboard, installed on an estimated 350,000 WordPress sites. CyberSignal Priority: 🔴 VERY HIGH 📅 August 28, 2026 🏷️ WordPress · Authentication Bypass · SSO · Web Security 🛡️ CVE-2026-76581 — CVSS 9.8 🎯 WPMU DEV Dashboard ≤ 5.0.1 ### 🔎 What happened The vulnerability exists inside WPMU DEV's Hub Single Sign-On flow. Two unauthenticated AJAX endpoints process HMAC-protected authentication data: wdpsso_step1 and wdpsso_step2. But they do NOT construct the signed message consistently. Step 1 signs: token + state + redirect + domain while Step 2 verifies: token + state + redirect without the domain field. ### ⚔️ Attack chain Unauthenticated attacker ↓ requests valid HMAC from Step 1 ↓ rearranges attacker-controlled fields ↓ replays HMAC against Step 2 ↓ verification succeeds ↓ WordPress authentication cookie issued ↓ **ADMINISTRATOR SESSION** If WordPress theme/plugin editing is available: admin takeover ↓ PHP modification ↓ potential server-side code execution. ### 🎯 Conditions The attack requires: WPMU DEV Dashboard ≤ 5.0.1 + Hub SSO enabled + SSO mapped to an administrator. Patched version: **5.0.2** ### 🧠 Why this matters The cryptography itself does not need to be broken. The attacker wins because two components disagree about: **what exactly was authenticated.** That's a protocol-design failure, not a weak-HMAC failure. ### 🛡️ Defender action Update immediately to 5.0.2. If patching cannot happen immediately: disable Hub SSO review administrator sessions inspect unexpected account/plugin/theme changes. CyberSignal Insight: **Strong cryptography cannot save a protocol when the signer and verifier disagree about what the signature means.** Sources: Wordfence · CVE-2026-76581 · WPMU DEV
Post summary
CVE-2026-76581 enables unauthenticated WordPress auth bypass via HMAC domain mismatch in WPMU DEV Dashboard; immediate update to 5.0.2 or disabling Hub SSO mitigates the flaw.
0000097
166 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-76581

Rıdvan Yağlı[verified]@ridvanyagliPatch

A critical authentication bypass vulnerability (CVE‑2026‑76581) was identified in WPMU DEV Dashboard, and users are advised to update to version 5.0.2 or newer for remediation.

!Manan[verified]@0xMananPatch

The post explains a canonicalization flaw in WPMU DEV SSO that allows replaying HMACs to elevate privileges, and it notes that version 5.0.2 includes a patch that mitigates the issue.

mohamedation[verified]@mohamedationActive Exploitation

The post cites ongoing attacks against CVE‑2026‑15981 and CVE‑2026‑76581 with no technical or mitigation details, indicating only that these CVEs are being actively exploited.

itsalreadywhen[verified]@itsalreadywhenExploit

The tweet outlines Microsoft’s TerminalFix variant and severe WordPress flaws that enable remote code execution and site takeover, though it provides no PoC, patch, or evidence of active exploitation.

DFIR Radar[verified]@DFIR_RadarPatch

The announcement details a critical authentication bypass in WPMU DEV Dashboard, explains how the exploit works, and provides immediate remediation steps including a patch to version 5.0.2.

mohamedation[verified]@mohamedationGeneral

The passage clarifies that CVE-2026-15981 is a miniOrange/SAML authentication bypass and that the WPMU DEV Dashboard issue corresponds to CVE-2026-76581, correcting earlier misidentification of the CVE numbers.

YBE[verified]@LumideezyPatch

The post emphasizes urgent patching of the high‑severity WPMU DEV Dashboard flaw (CVE‑2026‑76581) that allows unauthenticated admin takeover or RCE, providing vulnerability details but no exploit or active use evidence.

Security Arsenal, LLC[verified]@SecurityAr58409Disclosure

The post announces the discovery of critical WordPress plugin and theme vulnerabilities (CVE‑2026‑76581) disclosed by Wordfence and Patchstack, providing a link to a blog for further details and remediation guidance.