Description

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-08T06:16:37.957Z",
  "pubdate": "2026-10-08T06:16:37.957Z",
  "executiveSummary": "The Ultimate Multisite WordPress plugin contains a critical authentication bypass vulnerability that allows unauthenticated attackers to hijack existing WordPress accounts, including those with Network Super Admin privileges.\nThe flaw stems from improper input validation and normalization during the guest checkout process, enabling an attacker to force an account linkage between their session and a victim's email address.\nThis vulnerability is particularly severe as it bypasses previous security patches, specifically affecting versions up to and including 2.16.1.\nSuccessful exploitation requires knowledge of the target's email address and specific checkout configurations, such as the absence of a password field. Once exploited, an attacker gains full access to the target's account, leading to complete site compromise, data exfiltration, or unauthorized administrative actions.\nThe risk implication is extreme given that the vulnerability allows for privilege escalation to the highest possible authority within a WordPress multisite network without requiring any prior authentication or valid credentials.",
  "technicalDetails": "The vulnerability resides within the Ultimate Multisite plugin's customer account management and checkout logic, specifically how it handles the linkage between unauthenticated guest checkouts and existing WordPress user accounts.\nThe root cause is a dual-failure in authentication logic: first, the plugin fails to mandate authentication before linking a checkout session to a WordPress user; second, a discrepancy exists in how the plugin performs email address normalization during the duplicate-account check versus the lookup process utilized during customer creation.\nBecause the input normalization is inconsistent, an attacker can supply an email address that the system perceives as valid for an existing user account, effectively overriding or bypassing the logic intended to prevent account duplication or unauthorized linkage.\nExploitation is contingent upon the checkout form being configured to utilize auto-generated passwords rather than explicit user-provided authentication fields. When an attacker provides a known email address associated with an existing user, the plugin matches the request to that specific user record.\nThe attack flow proceeds as follows: 1) The attacker navigates to the checkout page configured for auto-generated passwords. 2) The attacker enters the target victim's email address. 3) Due to the normalization mismatch, the plugin fails to detect that the user already exists in a restricted capacity or incorrectly associates the checkout session with the legitimate user's profile. 4) The system automatically logs the attacker into the account associated with that email address. 5) If the target account is a Network Super Admin, the attacker inherits full administrative privileges.\nThis mechanism bypasses the previous partial fix implemented in version 2.15.1 for CVE-2026-75957, confirming that the underlying logic flaws remained unaddressed in all versions up to and including 2.16.1. The attack is executable over the network without any interaction from the victim beyond the existence of their account. Post-exploitation, the attacker maintains authenticated access to the target's session, enabling full control over the account and the associated multisite infrastructure."
}