The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
The WPMU DEV Dashboard plugin for WordPress contains a critical authentication bypass vulnerability (CVSS 9.8) affecting all versions through 5.0.1. The flaw stems from inconsistent HMAC message construction in the single sign-on flow: the initial `wdpsso_step1` action signs a concatenated token+state+redirect+domain string, while the verification in `wdpsso_step2` uses an unseparated concatenation that omits the domain field. This cryptographic mismatch allows unauthenticated attackers to forge valid HMAC signatures and bypass authentication entirely, potentially gaining unauthorized access to WordPress installations using this plugin for centralized user management across WPMU networks.
While this CVE currently maps to zero Casky skills, practitioners using Casky's Claude AI-powered analysis would benefit from its extended reasoning capabilities to identify the root cause: improper cryptographic validation tied to CWE-347 (Improper Verification of Cryptographic Signature). Security teams investigating this vulnerability should focus detection efforts on monitoring AJAX requests to `wdpsso_step1` and `wdpsso_step2` endpoints for anomalous HMAC signatures, tracking failed authentication attempts from unexpected sources, and correlating successful logins following suspicious AJAX activity. Practitioners would observe attack patterns resembling Initial Access techniques, specifically looking for evidence of forged authentication tokens being leveraged to establish unauthorized sessions without proper credential submission.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-76581. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation