Authentication Bypass Vulnerability in Ultimate Multisite Plugin for WordPress

CVE-2026-75957

What is CVE-2026-75957?

The Ultimate Multisite plugin for WordPress is susceptible to an authentication bypass due to a flaw in the login_customer_after_checkout function. The vulnerability arises from the publicly accessible AJAX handler, wu_ajax_nopriv_wu_validate_form, which permits the use of an easily obtainable checkout nonce. As a result, the checkout_form=wu-finish-checkout parameter can lead to the bypass of all validation rules, allowing unauthenticated attackers to log in as any existing WordPress user, including Network Super Admins, by simply knowing the user's email address. This risk particularly affects accounts that lack a pre-existing Ultimate Multisite customer record, making it crucial for administrators to secure their systems promptly.

References