A critical authentication bypass flaw in the WPMU DEV Dashboard plugin allows unauthenticated attackers to hijack administrative sessions on affected WordPress sites.

This vulnerability is an improper verification of cryptographic signatures (CWE-347) occurring within the wdpsso_step1 and wdpsso_step2 AJAX actions. An unauthenticated attacker can exploit inconsistent HMAC message construction to forge a valid administrative session.

The exploitation of this vulnerability grants an attacker full administrative access to the WordPress site. This leads to complete system compromise, including the ability to modify site content, install malicious plugins, exfiltrate sensitive user data, or redirect traffic. With a CVSS score of 9.8, this flaw presents an extreme risk to organizational integrity and data confidentiality.

Immediate Action: Ensure all instances of the WPMU DEV Dashboard plugin are updated to the latest available version provided by the vendor. If an update is not immediately possible, deactivate the plugin until a patch is applied.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the wdpsso_step1 and wdpsso_step2 endpoints. Monitor for unauthorized administrative logins or unexpected changes to user account permissions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious or malformed requests directed at the WPMU DEV plugin endpoints.

Public Exploit Available: No (Exploit status is currently unknown)

Given the critical severity and the potential for complete administrative takeover, organizations must prioritize the remediation of this vulnerability. Administrators should verify the current version of the WPMU DEV Dashboard plugin immediately and apply available updates to neutralize the risk of unauthorized session hijacking.