← Back to search

CVE-2026-103646

9.8 CRITICAL

Published 2026-10-08 · Updated 2026-10-08

AI risk analysis

Summary
The flaw allows unauthenticated attackers to log in as any existing user, including Network Super Admins, by exploiting a bypass in the Ultimate Multisite WordPress plugin before 2.17.0.
Exploitability
Exploitation requires a checkout form without a password field and a target account with no existing customer record. This is moderately hard to exploit.
Blast radius
If exploited, this can lead to full control over any user account, including Network Super Admins, with potential for widespread damage.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to Ultimate Multisite 2.17.0 or later.
auth-bypasswebwordpress

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.