Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-76581-Detector — Safe passive detector for identifying WPMU DEV Dashboard versions affected by CVE-2026-76581. | Kitploit
Tools/GitHubGitHub/hackersroot/cve-2026-76581-detector
Vulnerability ScannersWeb SecurityLearning & EducationCurated Resources
GitHubhackersroot/cve-2026-76581-detector

CVE-2026-76581-Detector

Safe passive detector for identifying WPMU DEV Dashboard versions affected by CVE-2026-76581.

View Repository
4h 43m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-76581 - WPMU DEV Dashboard Vulnerability Detector

A safe, passive Python detector for identifying WordPress installations running a version of WPMU DEV Dashboard affected by CVE-2026-76581.

The detector does not exploit the authentication bypass, request or replay HMAC values, or create an administrator session.

Sanitized CVE-2026-76581 detector demonstration

The screenshot is a sanitized demonstration for educational purposes. It contains no real target, payload, authentication token, or credential.

Vulnerability summary

FieldInformation
CVECVE-2026-76581
ProductWPMU DEV Dashboard
Plugin slugwpmudev-updates
VulnerabilityAuthentication bypass
CVSS9.8 - Critical
Affected versions5.0.1 and earlier
Patched version5.0.2

The flaw is caused by inconsistent HMAC message construction in the Hub SSO flow. Successful exploitation also requires a connected WPMU DEV site with Hub SSO enabled. This project deliberately does not exercise that authentication flow.

Features

  • Passive version detection
  • Direct local plugin-header inspection
  • Remote public-metadata inspection
  • No authentication-bypass attempt
  • No HMAC collection or replay
  • No administrator session creation
  • Colored terminal interface
  • JSON output
  • No third-party Python packages

Requirements

  • Python 3.10 or newer
  • A WordPress installation you own or are authorized to assess

Usage

Check localhost using public metadata:

root@kitploit:~
python CVE-2026-76581-detector.py http://localhost

For the most reliable result, read the installed plugin header directly.

XAMPP on Windows:

root@kitploit:~
python CVE-2026-76581-detector.py http://localhost --wordpress-path "C:\xampp\htdocs\wordpress"

WAMP on Windows:

root@kitploit:~
python CVE-2026-76581-detector.py http://localhost --wordpress-path "C:\wamp64\www\wordpress"

Linux:

root@kitploit:~
python3 CVE-2026-76581-detector.py http://localhost --wordpress-path /var/www/html/wordpress

Authorized remote passive check:

root@kitploit:~
python3 CVE-2026-76581-detector.py https://authorized-site.example

JSON output:

root@kitploit:~
python3 CVE-2026-76581-detector.py http://localhost --json

Result meanings

VULNERABLE VERSION DETECTED

WPMU DEV Dashboard 5.0.1 or earlier was positively identified. The installed version is within the affected range. This does not claim that Hub SSO is enabled or that account takeover was demonstrated.

PATCHED BY VERSION

The detected plugin version is 5.0.2 or later.

INCONCLUSIVE

Reliable version evidence was unavailable. This can happen when public metadata is blocked, the site is unreachable, or the plugin uses a nonstandard layout. An inconclusive result does not prove the site is secure. Use --wordpress-path when local filesystem access is available.

Remediation

If an affected version is detected:

  1. Update WPMU DEV Dashboard to version 5.0.2 or newer.
  2. Disable Hub SSO until the update is complete.
  3. Review the account mapped to Hub SSO.
  4. Examine administrator accounts and active sessions.
  5. Review recent plugin, theme, and configuration changes.
  6. Investigate unexpected administrative activity.

Exit codes

CodeMeaning
0Patched, inconclusive, or plugin not found
1Vulnerable plugin version detected
2Invalid target or command usage

Ethical-use notice

This project is intended for defensive security testing, authorized assessments, local laboratory research, patch verification, and education. Do not assess systems without explicit authorization.

References

  • Wordfence technical disclosure
  • Wordfence vulnerability record
  • Official CVE record

Author

Sandeep Vishwakarma
Information Security Consultant and Bug-Bounty Hunter

Disclaimer

This project is provided strictly for authorized testing and defensive research. The author is not responsible for misuse or damage resulting from this project.

Download Tool