Loading vulnerability…
CVE-2026-76581 is an unauthenticated authentication-bypass vulnerability in the WPMU DEV Dashboard plugin for WordPress through version 5.0.1. Hub SSO uses inconsistent, ambiguously concatenated HMAC message inputs across its two unauthenticated AJAX SSO steps. The first step signs token, state, redirect, and domain values, whereas the second verifies a concatenation that omits the domain value. An attacker can obtain a valid signature from the first step and replay it to the second step by shifting the domain value into the redirect field, causing the plugin to authenticate the attacker as the WordPress user configured for Hub SSO.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This 17-file repository is a standalone Python proof-of-concept and Docker test lab for a claimed WPMU DEV Dashboard/WordPress authentication bypass, not a Metasploit, Nuclei, or other exploit-framework module. The primary entry point, poc.py, uses requests with TLS verification disabled and an identifiable scanner User-Agent (AttackWatch-PoC-Scanner/1.0). It normalizes a supplied target, probes common WPMU DEV plugin paths, extracts readme or header versions, treats versions <=5.0.1 as potentially vulnerable, and contains an active WordPress AJAX assessment path targeting admin-ajax.php. The demonstrated vulnerability is an HMAC construction error: step 1 signs token+state+redirect+domain without delimiters, whereas step 2 validates token+state+redirect. By choosing field values whose concatenation remains identical after moving domain into redirect, a signature from step 1 is accepted by step 2 and results in an administrator-mapped SSO session. The repository includes vulnerable-app/app.py, a deliberately insecure Flask simulation that exposes this behavior, and patched-app/app.py, which demonstrates remediation through canonical JSON serialization, signing the same fields in both steps, domain/HTTPS redirect validation, server-side token binding, expiration, and single-use enforcement. Docker Compose maps the vulnerable and patched applications to localhost:8080 and localhost:8081 respectively; Bash and PowerShell runners invoke the PoC against both. No shell, command-execution, persistence, credential theft, or exfiltration payload is present. Notably, the local Flask lab uses /ajax/wdpsso_step1 and /ajax/wdpsso_step2 while the scanner targets WordPress /wp-admin/admin-ajax.php, so the included runner/lab is primarily a conceptual comparison environment rather than a direct end-to-end execution of the WordPress-targeting path.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authentication-bypass vulnerability in WPMU DEV Dashboard for WordPress through version 5.0.1. Ambiguous, inconsistent HMAC message construction in the wdpsso_step1 and wdpsso_step2 unauthenticated AJAX actions enables an attacker to reuse a valid HMAC with manipulated field placement and obtain an administrator session where Hub SSO is enabled and mapped to an administrator.
Critical (CVSS 9.8) network-reachable authentication-bypass vulnerability in the WPMU DEV Dashboard WordPress plugin through version 5.0.1. Ambiguous, inconsistent HMAC canonicalization in Hub SSO AJAX flows permits a valid signature obtained in step 1 to be replayed to step 2 with manipulated parameter boundaries, yielding an administrator session on sites with Hub SSO enabled and mapped to an administrator.
Critical (CVSS 9.8) unauthenticated authentication-bypass flaw caused by ambiguous, inconsistent HMAC message construction between the wdpsso_step1 and wdpsso_step2 Hub SSO AJAX actions. On connected sites with Hub SSO enabled and mapped to an administrator, exploitation can yield full administrator access and site compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.