WordPress Multisite Plugin Authentication Bypass via AJAX Nonce

The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_customer_after_checkout` function. This is due to the publicly accessible `wu_ajax_nopriv_wu_validate_form` AJAX handler accepting a freely obtainable checkout nonce, and the `checkout_form=wu-finish-checkout` parameter causing `get_validation_rules()` to discard all validation rules while `finish_checkout_form_fields()` returns an empty step list — forcing `is_last_step()` to return true and routing the request directly into full order processing — after which `maybe_create_customer()` resolves the attacker-supplied `email_address` to an existing WordPress user ID without any authentication or ownership verification, and `login_customer_after_checkout()` calls `wp_set_auth_cookie()` for that user ID via a passwordless code path. This makes it possible for unauthenticate

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Ultimate Multisite WordPress plugin contains a critical authentication bypass vulnerability (CVSS 9.8) affecting all versions through 2.15.0. The flaw exists in the `wu_ajax_nopriv_wu_validate_form` AJAX handler, which accepts publicly available checkout nonces and fails to validate input when the `checkout_form` parameter is set to `wu-finish-checkout`. This causes the validation rules to be completely discarded, allowing unauthenticated attackers to bypass authentication mechanisms and gain unauthorized access to customer accounts and administrative functions. Any WordPress installation running this plugin becomes a direct target, as the vulnerability requires no authentication and can be exploited by remote attackers to compromise site security and customer data.

Casky's 283 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques underlying this vulnerability. Practitioners using the platform would observe detection patterns identifying: suspicious AJAX requests to `wu_ajax_nopriv_wu_validate_form` with missing or improperly validated nonces, abnormal checkout form submissions lacking expected validation rule enforcement, and authentication state changes occurring without proper credential verification. The system would flag requests where validation rules are selectively disabled, unusual account access patterns following checkout submissions, and privilege escalation attempts that bypass normal authentication workflows. By correlating these indicators against MITRE ATT&CK techniques, security teams gain visibility into exploitation attempts and can respond before unauthorized access is established.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75957.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-75957

Casky has 283 skills that investigate the attack patterns behind CVE-2026-75957. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn