The Ultimate Multisite WordPress plugin allows a logged‑out user to link a checkout to a new customer record that is automatically created with a generated password. If the user’s email matches an existing WordPress account, the plugin’s duplicate‑account check normalizes that address differently from the lookup used to create the customer, enabling the attacker to log in as that account without knowing its password. This flaw permits unauthenticated, remote bypass of authentication.

All versions of Ultimate Multisite before 2.17.0 are affected, including 2.15.1 through 2.16.1. The vulnerability remains present in any release that would have been covered by the 2.15.1 fix for CVE-2026‑75957.

The flaw is an authentication bypass (CWE-287). The attacker requires a checkout form configured without a password field and a target account that has no existing Ultimate Multisite customer record. Because the vulnerability can be exercised without user credentials, the risk is high; the CVSS score of 9.8 indicates a critical severity and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the unauthenticated checkout endpoint exposed by the plugin. If exploited, an attacker could gain full access to the WordPress account, including Network Super Admin privileges, leading to full site compromise.