Ultimate Multisite: Checkout authentication bypass to Network Super Admin
An unauthenticated attacker who knows an existing user's email can be linked to and logged in as that account through checkout. The duplicate-account check and customer lookup normalize the submitted email differently. Exploitation requires a checkout configured with an auto-generated password instead of a password field, and a target WordPress account with no existing Ultimate Multisite customer record. Network Super Admin accounts can be targets. The earlier 2.15.1 fix for CVE-2026-75957 does not address this bypass, which remains exploitable through 2.16.1. The export does not identify the checkout endpoint or exact normalization difference. Affected versions: < 2.17.0. The authoritative export identifies 2.17.0 as fixed for this CVE.
- Component
- Ultimate Multisite
- Plugin slug
ultimate-multisite- Affected
- < 2.17.0
- Safe version
2.17.0- Published
- Oct 08, 2026
This CVE was published Oct 08, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update to 2.17.0 or a later supported release. Application-level remediation: Require proof of control of an existing account before linking or creating a logged-in session. Apply the same canonical email normalization to duplicate checks and customer lookup, and never treat knowledge of an email address as authentication. Audit unexpected account linking and privileged logins.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H