IT SBIT Services
Schneeberger
DEEN
CVE tracker

Ultimate Multisite: Authentication bypass via checkout form

CVE-2026-75957Critical 9.8

← All vulnerabilities

Summary

Ultimate Multisite is a WordPress Multisite plugin for building and operating Website-as-a-Service platforms. In versions up to and including 2.15.0, an unauthenticated attacker can abuse the public checkout AJAX handler to log in as any existing WordPress user, including a Network Super Admin, knowing only the email address. Exploitation requires that the target account has no Ultimate Multisite customer record, which applies to administrators and editors created before the plugin was configured.

Affected

  • Ultimate Multisite up to and including 2.15.0

Fixed in

  • 2.15.1 fixes CVE-2026-75957 according to Patchstack and the WordPress.org changelog.
  • CVE-2026-103646 (email_address parameter) is not fixed by 2.15.1. Its fix is reported in 2.17.0.
  • Latest safe version: Unknown. 2.17.2 is referenced as fixing CVE-2026-107508 (local file inclusion), but the current latest release could not be verified.

Workaround

  • No vendor-documented workaround.
  • Restrict or disable the public checkout if it is not needed.

Exploitation

  • Unauthenticated and network-reachable, no user interaction. CVSS 3.1 score 9.8.
  • CISA SSVC: automatable yes, technical impact total.
  • Not recorded in the CISA KEV catalog. No public exploit code confirmed (unverified).
  • Patchstack expects exploitation; this is a prediction, not an observed campaign.

Our recommendation

  • Update Ultimate Multisite to 2.17.2 or later, not only to 2.15.1, and check for newer releases.
  • Review administrator and Network Super Admin accounts and recent logins for unexpected sessions.
  • Rotate admin passwords and invalidate sessions after patching.
  • Check whether the public checkout is exposed and restrict it if it is not needed.
  • Monitor logs for admin logins from unknown sources.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:38.

Original description (NVD)

The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_customer_after_checkout` function. This is due to the publicly accessible `wu_ajax_nopriv_wu_validate_form` AJAX handler accepting a freely obtainable checkout nonce, and the `checkout_form=wu-finish-checkout` parameter causing `get_validation_rules()` to discard all validation rules while `finish_checkout_form_fields()` returns an empty step list — forcing `is_last_step()` to return true and routing the request directly into full order processing — after which `maybe_create_customer()` resolves the attacker-supplied `email_address` to an existing WordPress user ID without any authentication or ownership verification, and `login_customer_after_checkout()` calls `wp_set_auth_cookie()` for that user ID via a passwordless code path. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including a Network Super Admin — simply by knowing their email address. Exploitation requires that the targeted user account has no pre-existing Ultimate Multisite customer record; accounts such as a Network Super Admin on a fresh Multisite install, or any administrator or editor added before Ultimate Multisite was configured, satisfy this condition and are therefore exploitable.

NVD references (13)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed