CVE-2026-103646 in Ultimate Multisite Plugin
Summary
by MITRE • 10/08/2026
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in The Ultimate Multisite WordPress plugin prior to version 2.17.0 represents a critical authentication bypass rooted in flawed logic within the account creation and checkout processes. This flaw allows an unauthenticated attacker to assume the identity of any existing user on the WordPress installation, including high-privilege accounts such as Network Super Administrators, provided their email address is known. The core technical issue stems from a discrepancy in how duplicate account checks are handled during the registration process compared to the lookup mechanism used when creating customer records for checkout operations. Specifically, the plugin normalizes submitted email addresses differently in these two contexts, leading to a situation where an attacker can exploit this inconsistency to bypass authentication requirements entirely.
The operational mechanics of this exploitation rely on specific configuration conditions within the WordPress site and the plugin itself. For the attack to succeed, the checkout form must be configured without requiring a password field, meaning passwords are auto-generated or not set during initial interaction. Furthermore, the target account must lack an existing customer record within The Ultimate Multisite plugin database. When an unauthenticated user submits their email address through this specific checkout flow, the system fails to properly validate whether that email corresponds to an already registered WordPress user in a way that prevents login. Instead, due to the normalization mismatch between the duplicate check and the customer creation lookup, the system inadvertently links the logged-out checkout session to the existing WordPress account associated with that email address. This effectively logs the attacker into the victim's account without requiring any credentials other than knowledge of the target's email address.
This vulnerability is particularly severe because it circumvents standard authentication mechanisms, allowing for unauthorized access to sensitive administrative functions if the targeted user holds elevated privileges. The impact extends beyond simple identity theft; an attacker with Super Admin rights could potentially modify site configurations, install malicious plugins, or exfiltrate database contents. It was noted that a previous fix intended to address related issues in version 2.15.1, referenced as CVE-2026-75957, failed to resolve this specific logical flaw. Consequently, the vulnerability remains exploitable across all versions up to and including 2.16.1, indicating that earlier remediation efforts were incomplete or misaligned with the actual code paths involved in this attack vector.
From a classification perspective, this issue aligns with CWE-287, which describes Improper Authentication, specifically involving the failure to verify identity before granting access. The exploitation technique mirrors behaviors observed in ATT&CK tactic T1078, Valid Accounts, where adversaries leverage legitimate credentials or account properties to gain initial access and maintain persistence within a network environment. Although no traditional password is stolen, the ability to assume an existing user's session constitutes a significant breach of integrity and confidentiality principles defined by industry security standards.
Mitigation strategies must focus on immediate patching and configuration hardening. The primary remediation step is to upgrade The Ultimate Multisite plugin to version 2.17.0 or later, where the normalization logic has been corrected to ensure consistent handling of email addresses across all authentication and customer creation workflows. Until an update can be applied, administrators should consider disabling public registration if not strictly necessary, ensuring that checkout forms require explicit password entry rather than auto-generation for new accounts, and implementing additional monitoring for unusual login patterns associated with known administrative emails. Regular security audits and penetration testing are recommended to identify similar logical flaws in other plugins or custom code within the WordPress ecosystem.