Ultimate Multisite WordPress Plugin Authentication Bypass Vulnerability

The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to an authentication bypass in all versions up to, and including, 2.15.0.

The flaw is triggered via the checkout_form parameter of the login_customer_after_checkout function. The publicly accessible wu_ajax_nopriv_wu_validate_form AJAX handler accepts a freely obtainable checkout nonce, and the checkout_form=wu-finish-checkout parameter causes get_validation_rules() to discard all validation rules while finish_checkout_form_fields() returns an empty step list. This forces is_last_step() to return true and routes the request directly into full order processing. Afterwards, maybe_create_customer() resolves the attacker-supplied email_address to an existing WordPress user ID without any authentication or ownership verification, and login_customer_after_checkout() calls wp_set_auth_cookie() for that user ID via a passwordless code path.

This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including a Network Super Admin — simply by knowing their email address.

• Affected versions: all versions up to and including 2.15.0
• Precondition: the targeted user account has no pre-existing Ultimate Multisite customer record
• Exploitable accounts include a Network Super Admin on a fresh Multisite install, or any administrator or editor added before Ultimate Multisite was configured