CVE-2026-103646: unknown ultimate multisite Improper Authentication

Vulnerability summary

CVE-2026-103646 is a critical (CVSS 9.8) Improper Authentication vulnerability in unknown ultimate multisite. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.1% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.17.0.

Timeline

1. 08-10-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.