WPMU DEV Dashboard: Hub SSO Authentication Bypass to Admin Takeover (CVE-2026-76581)

Introduction

The WPMU DEV Dashboard plugin had a critical authentication bypass vulnerability disclosed as CVE-2026-76581 (CVSS 9.8). On sites with Hub Single Sign-On (SSO) enabled and mapped to an administrator account, an unauthenticated attacker can exploit the flaw to obtain administrator access and take over the site.

What You Should Do Right Now

1. Check if WPMU DEV Dashboard is installed under Plugins in wp-admin, and confirm the version.
2. Check whether Hub SSO is enabled and mapped to an administrator account — this is the specific condition that makes a site exploitable.
3. Back up your site immediately before updating.
4. Update to the patched version as soon as it’s confirmed available.
5. Review your admin user list and login activity for anything unfamiliar, especially if Hub SSO has been enabled for a while.

Why Conditional Vulnerabilities Still Deserve Full Attention

This flaw only affects sites with a specific configuration — Hub SSO enabled and mapped to an admin. It’s tempting to read that as “probably not me” and move on. But WPMU DEV Dashboard is specifically popular with agencies and freelancers managing multiple client sites, exactly the audience most likely to have SSO convenience features turned on across their whole portfolio. If you manage more than one site with this plugin, check every single one rather than assuming your usual site is representative.

FAQ

How do I check if Hub SSO is enabled on my site?
Check the WPMU DEV Dashboard plugin’s settings in wp-admin for SSO or Hub login configuration.

I manage multiple client sites with this plugin — do I need to check all of them?
Yes. Configuration varies per site, so a check on one site doesn’t tell you the status of another.

What if I don’t use Hub SSO at all?
Update anyway as good practice, but this specific CVE’s exploitation path depends on Hub SSO being enabled and mapped to an admin account.

Conclusion

If you or your agency manages sites with WPMU DEV Dashboard and Hub SSO, check every site’s configuration and update without delay — this is a favorite target profile for agencies managing many sites at once.