Filtered by category: WordFence, tag: unauthenticated exploit × Clear
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
Matched: WordPress
A critical authentication bypass (CVE-2026-76581, CVSS 9.8) was found in WPMU DEV Dashboard, a WordPress plugin with ~350,000 installations. When Hub SSO is enabled, unauthenticated attackers can exploit inconsistent HMAC construction across two SSO steps to gain administrator access and potentially execute remote code. The flaw was patched in version 5.0.2, released August 24, 2026. Users unable to update should disable Hub SSO immediately.