{"id":"CVE-2026-103646","published":"2026-10-08T06:16:37.957","lastModified":"2026-10-08T20:51:18.123","description":"The Ultimate Multisite  WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know.\nThis bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite  WordPress plugin before 2.17.0.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/a05da0ad-5d92-406f-b182-b3ed1f8389f3/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthenticated attackers to log in as any existing user, including Network Super Admins, by exploiting a bypass in the Ultimate Multisite WordPress plugin before 2.17.0.","exploitability":"Exploitation requires a checkout form without a password field and a target account with no existing customer record. This is moderately hard to exploit.","blast_radius":"If exploited, this can lead to full control over any user account, including Network Super Admins, with potential for widespread damage.","remediation":"Upgrade to Ultimate Multisite 2.17.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","wordpress"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:42:58.524Z"}}