The vulnerability lies in inconsistent construction of HMAC signatures between two SSO AJAX actions in the WPMU DEV Dashboard plugin. Step 1 signs and reveals a concatenation of token, state, redirect and domain, whereas step 2 verifies a concatenation that omits the domain field. An attacker who can trigger the first action can retrieve a valid HMAC and then replay that signature in the second action by putting the domain value into the redirect parameter, enabling creation of an authenticated administrator session without prior authentication. This results in full administrative privileges on the WordPress site.

Vendor is wpmudev and the product is the WPMU DEV Dashboard plugin for WordPress. All versions up to and including 5.0.1 are affected. Any WordPress site that has the plugin installed, Hub SSO enabled, and a Hub account mapped to an administrator is vulnerable.

The CVSS score of 9.8 indicates critical severity. EPSS is not available, and it is not listed in CISA KEV. Attackers need only be able to send requests to the exposed AJAX endpoints; no privileged user or admin credentials are required. Because the vulnerability can be triggered from an unauthenticated web request, it is exploitable over a public interface if the site is reachable. The application handles user authentication via SSO, so the flaw effectively bypasses the normal authentication mechanism.