WordPress Plugin Authentication Bypass via Email Normalization

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Ultimate Multisite WordPress plugin before version 2.17.0 contains a critical authentication bypass vulnerability that allows unauthenticated attackers to hijack any user account, including Network Super Admin accounts, by exploiting inconsistent email address normalization logic. The vulnerability exists in the checkout flow where the plugin fails to require authentication before linking a logged-out checkout to an existing WordPress account. Because the duplicate-account check normalizes email addresses differently than the account lookup mechanism, an attacker knowing a target's email address can exploit this discrepancy to gain unauthorized access. With a CVSS score of 9.8, this affects all WordPress installations using vulnerable versions of the plugin, creating immediate risk for multi-site WordPress networks and their administrative infrastructure.

Casky's 283 mapped security skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK Initial Access (TA0004) and Credential Access (TA0006) tactics. Practitioners using Casky would observe detection signals for suspicious authentication attempts originating from unauthenticated sessions, anomalous account linkage operations during checkout processes, and privilege escalation patterns where standard user accounts suddenly exhibit Network Super Admin behavior. The platform's reasoning engine would correlate email normalization anomalies (such as whitespace handling or case sensitivity mismatches) with subsequent lateral movement, flagging the characteristic signature of attackers testing multiple known email addresses to gain administrative access. Real-world findings would show repeated failed checkout-to-account associations followed by successful privileged logins from previously unseen IP addresses—precisely the behavioral chain this CWE-287 (Improper Authentication) vulnerability enables.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-103646.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-103646

Casky has 283 skills that investigate the attack patterns behind CVE-2026-103646. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn