CVE-2026-75957

Summary

The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkout_form parameter of the login_customer_after_checkout function. This is due to the publicly accessible wu_ajax_nopriv_wu_validate_form AJAX handler accepting a freely obtainable checkout nonce, and the checkout_form=wu-finish-checkout parameter causing get_validation_rules() to discard all validation rules while finish_checkout_form_fields() returns an empty step list — forcing is_last_step() to return true and routing the request directly into full order processing — after which maybe_create_customer() resolves the attacker-supplied email_address to an existing WordPress user ID without any authentication or ownership verification, and login_customer_after_checkout() calls wp_set_auth_cookie() for that user ID via a passwordless code path. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including a Network Super Admin — simply by knowing their email address. Exploitation requires that the targeted user account has no pre-existing Ultimate Multisite customer record; accounts such as a Network Super Admin on a fresh Multisite install, or any administrator or editor added before Ultimate Multisite was configured, satisfy this condition and are therefore exploitable.

Affected Software

VendorProductVersion RangeStatus
superdav42Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform0 <= 2.15.0affected

Weaknesses

  • CWE-287: CWE-287 Improper Authentication

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References