Authentication bypass in Ultimate Multisite WordPress plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.
Summary
The Ultimate Multisite WordPress plugin before 2.17.0 is affected. A logged-out checkout is linked to and logged in as an existing account matching the submitted email address without authentication, because the duplicate-account check normalizes the address differently from the lookup used to create the customer (CWE-287). An unauthenticated remote attacker who knows a user's email address can log in as that user, including a Network Super Admin. The references include an exploit link.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Ultimate Multisite | before 2.17.0 | 2.17.0 | Patch available | CNA |
- Ultimate Multisite VendorUnknown Affected before 2.17.0 Fixed in 2.17.0 Patch available CNA
Remediation
Update the Ultimate Multisite WordPress plugin to version 2.17.0, which fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Ultimate Multisite (Unknown) Fixed in 2.17.0
Timeline
- 2026-10-08 Threatist record created from CVE-2026-103646
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences