Wordfence’s Argus research initiative has disclosed a critical authentication bypass vulnerability in WPMU DEV Dashboard, a WordPress plugin used on an estimated 350,000 active sites. The flaw was found during internal research and reported on August 19th, 2026.
According to Wordfence, the vulnerability allows unauthenticated attackers to gain administrator-level access to affected sites when the plugin’s Hub Single-Sign On feature is enabled. Because Hub SSO is a common convenience feature for site owners managing multiple WordPress installations through WPMU DEV’s Hub service, sites that rely on it are directly exposed to this issue.
Why This Matters
Gaining administrator access through an authentication bypass effectively hands an attacker the keys to the site. Wordfence notes that this can lead to complete site takeover. If an admin-accessible code-write mechanism, such as the built-in WordPress plugin or theme editor, is available on the compromised site, the vulnerability can escalate further into remote code execution, giving an attacker the ability to run arbitrary code on the server.
This combination, unauthenticated access straight to an administrator role, ranks among the most severe categories of WordPress vulnerabilities because it requires no credentials, no social engineering, and no prior foothold on the site.
What Site Owners Should Do
- Check whether WPMU DEV Dashboard is installed and confirm whether Hub Single-Sign On is enabled on your site.
- Watch for an official security update from WPMU DEV and apply it as soon as it becomes available.
- If Hub SSO is not actively needed, consider disabling it until a fix is confirmed and deployed.
- Review the WordPress plugin and theme editor access on your site, since restricting or disabling these built-in code editors reduces the impact if an account is compromised.
- Site owners running a web application firewall or security plugin should ensure protection rules are current, as these can mitigate exploitation attempts against known vulnerability classes like this one.
Wordfence’s disclosure did not include a specific patched version number in the material reviewed here, so administrators should monitor the plugin’s changelog and WPMU DEV’s official channels for an update addressing this authentication bypass.