type: vulnerability · created: 2026-08-30 · updated: 2026-08-30 · tags: [cve, wordpress, wpmu-dev-dashboard, auth-bypass, account-takeover, critical] · confidence: high · severity: critical · affected_sectors: [Global (Macro)] · au_impact: false
CVE-2026-76581
CVE-2026-76581 is a critical authentication-bypass vulnerability (CVSS 9.8) in the WPMU DEV Dashboard WordPress plugin. The flaw allows an unauthenticated attacker to bypass authentication through the Hub single sign-on flow and take over an administrator account, giving full control of the affected site.
Disclosed by Wordfence and Patchstack on 29 August 2026 as part of five critical WordPress plugin and theme flaws, the WPMU DEV Dashboard ships with the widely used WPMU DEV product suite. No in-the-wild exploitation had been disclosed at publication, but the authentication-bypass nature of the flaw warrants urgent patching before attackers weaponise it.