Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Ultimate Multisite plugin lets attacker log in as any user

CVE-2026-103646 · published 2 days ago
Summary

The Ultimate Multisite WordPress plugin versions before 2.17.0 can be tricked into signing in a visitor as any existing account simply by submitting the account's email address during checkout. This means an unauthenticated person could gain the same access rights as the targeted user, even a Network Super Admin. Update the plugin to version 2.17.0 or later to stop this behavior.

What to do
  • Update unknown ultimate multisite to version 2.17.0 or later.
Affected software
VendorProductAffected versions
unknown ultimate multisite < 2.17.0
Original advisory text
Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know.
This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published8 Oct 2026
Updated10 Oct 2026
First seen8 Oct 2026
Sources
CVE-2026-103646 · NVD
CVE-2026-103646 · MITRE
Track software like this
Free during beta