Wordfence Finds Critical Admin Takeover Bug in WPMU DEV Dashboard

The WPMU DEV Dashboard WordPress plugin has a critical authentication bypass vulnerability that can let an unauthenticated attacker gain administrator access when a feature called Hub Single Sign-On is enabled, according to a security research report published by Wordfence Argus on August 19th, 2026. Wordfence Argus is the threat research team at Wordfence, a company that builds WordPress security tools and services. The plugin is used on an estimated 350,000 active installations.

An authentication bypass is a weakness that allows someone to skip the normal login step and get into an account or area as if they were a valid user. In this case, the vulnerability only applies when Hub Single Sign-On, often shortened to Hub SSO, is turned on. Hub SSO is a setting that lets a person log in to a WordPress website through the WPMU DEV Hub service instead of typing a separate WordPress password. When Hub SSO is active, the flaw makes it possible for an unauthenticated attacker, meaning someone who is not logged in and has no account on the site, to obtain administrator access.

Administrator access is the highest permission level in WordPress and gives full control over the website. An attacker with this access can change passwords, add new administrator accounts, install malicious plugins, modify pages, and read any data stored in WordPress. The Wordfence report notes that when an administrator-accessible code-write mechanism such as the WordPress plugin editor or theme editor is available, the situation can escalate to remote code execution. Remote code execution means the attacker can run their own commands or programs on the server that hosts the website, which can put the entire hosting account at risk.

The vulnerability was found during internal research by Wordfence Argus. The published report does not include detailed technical information about the exact flaw, and it does not say whether a patch was available at the time of publication. Because the issue is triggered only when Hub Single Sign-On is enabled, sites that have not activated that feature are not exposed through this specific vulnerability. Site owners who use the plugin should check their settings immediately.

For website owners, the immediate step is to review the Hub Single Sign-On setting in the WPMU DEV Dashboard. If Hub SSO is not needed, it should be turned off. If it is needed, site owners should watch for an update from WPMU DEV and apply it as soon as it is released. Limiting access to the WordPress plugin and theme editor can also reduce the risk of remote code execution even if an attacker somehow gains administrator access.

WordPress plugin vulnerabilities can provide a direct path into a website, especially when a plugin is as widely installed as WPMU DEV Dashboard. Because plugins extend the base WordPress software with new functions, a weakness in any one of them can undermine the security of the whole site. This is why plugin updates and configuration reviews are an important part of routine website maintenance. Managed WordPress hosting services such as AEU Hosting provide a secured, end-to-end environment that can help website owners keep their installations and plugins better maintained.