CVE-2026-103646 Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter
Unauthenticated attackers can log in as any user, including admins, by exploiting email normalization flaws in the checkout process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103646?
CVE-2026-103646 is a critical authentication bypass vulnerability in Unknown Ultimate Multisite, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.
Weakness: CWE-287
Which versions are affected by CVE-2026-103646?
How do I fix CVE-2026-103646?
No fix has been published for CVE-2026-103646 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-103646 being exploited?
There is no known exploitation of CVE-2026-103646 in the wild and no public exploit code.
Sources
Also known as GHSA-3qw6-7g4w-jh2g.