Ultimate Multisite: Authentication bypass via checkout email address
Summary
The WordPress plugin Ultimate Multisite before 2.17.0 links a logged-out checkout to an existing WordPress account with the same email address and logs the visitor in, without requiring authentication. Its duplicate-account check normalizes the email address differently from the customer lookup, so an unauthenticated attacker who knows a user's email address can log in as that user, including a Network Super Admin. Exploitation requires a checkout form without a password field (auto-generated password) and a target account that has no existing customer record. The 2.15.1 fix for CVE-2026-75957 does not address this bypass.
Affected
- Ultimate Multisite versions before 2.17.0 (per the CVE record and WPScan)
- Versions up to and including 2.16.1 are stated to be affected by this bypass
Fixed in
- 2.17.0 (WPScan lists 2.17.0 as the fixed version)
- Latest release at the time of research: 2.17.2 (fixes a separate local file access issue)
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- No public proof-of-concept or exploitation reports were found at the time of research
Our recommendation
- Update Ultimate Multisite to the latest 2.17.x release (currently 2.17.2) as a priority
- Check whether checkout forms are configured without a password field and disable this setting if possible until the update is applied
- Review accounts with administrative rights, especially Network Super Admins, and check for unexpected logins
- Monitor logs for logins by checkout customers that match existing accounts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- WordPress.org plugin page wordpress.org
- GitHub release v2.17.0 github.com
- GitHub release v2.17.2 github.com
- VulDB entry vuldb.com
- Strix CVE page www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:35.
Original description (NVD)
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.