
Safe passive detector for identifying WPMU DEV Dashboard versions affected by CVE-2026-76581.
A safe, passive Python detector for identifying WordPress installations running a version of WPMU DEV Dashboard affected by CVE-2026-76581.
The detector does not exploit the authentication bypass, request or replay HMAC values, or create an administrator session.

The screenshot is a sanitized demonstration for educational purposes. It contains no real target, payload, authentication token, or credential.
| Field | Information |
|---|
| CVE | CVE-2026-76581 |
| Product | WPMU DEV Dashboard |
| Plugin slug | wpmudev-updates |
| Vulnerability | Authentication bypass |
| CVSS | 9.8 - Critical |
| Affected versions | 5.0.1 and earlier |
| Patched version | 5.0.2 |
The flaw is caused by inconsistent HMAC message construction in the Hub SSO flow. Successful exploitation also requires a connected WPMU DEV site with Hub SSO enabled. This project deliberately does not exercise that authentication flow.
Check localhost using public metadata:
python CVE-2026-76581-detector.py http://localhost
For the most reliable result, read the installed plugin header directly.
XAMPP on Windows:
python CVE-2026-76581-detector.py http://localhost --wordpress-path "C:\xampp\htdocs\wordpress"
WAMP on Windows:
python CVE-2026-76581-detector.py http://localhost --wordpress-path "C:\wamp64\www\wordpress"
Linux:
python3 CVE-2026-76581-detector.py http://localhost --wordpress-path /var/www/html/wordpress
Authorized remote passive check:
python3 CVE-2026-76581-detector.py https://authorized-site.example
JSON output:
python3 CVE-2026-76581-detector.py http://localhost --json
WPMU DEV Dashboard 5.0.1 or earlier was positively identified. The installed version is within the affected range. This does not claim that Hub SSO is enabled or that account takeover was demonstrated.
The detected plugin version is 5.0.2 or later.
Reliable version evidence was unavailable. This can happen when public metadata is blocked, the site is unreachable, or the plugin uses a nonstandard layout. An inconclusive result does not prove the site is secure. Use --wordpress-path when local filesystem access is available.
If an affected version is detected:
| Code | Meaning |
|---|---|
0 | Patched, inconclusive, or plugin not found |
1 | Vulnerable plugin version detected |
2 | Invalid target or command usage |
This project is intended for defensive security testing, authorized assessments, local laboratory research, patch verification, and education. Do not assess systems without explicit authorization.
Sandeep Vishwakarma
Information Security Consultant and Bug-Bounty Hunter
This project is provided strictly for authorized testing and defensive research. The author is not responsible for misuse or damage resulting from this project.