CVE-2026-75957Published
Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-75957 · Microsoft / collected KEV context
cve-program · CVE-2026-75957
- https://www.wordfence.com/threat-intel/vulnerabilities/id/66cb8c6f-d405-4115-a626-040e9b5b1e62?source=cve
- https://plugins.trac.wordpress.org/browser/ultimate-multisite/tags/2.15.0/inc/checkout/class-checkout.php#L2489
- https://plugins.trac.wordpress.org/browser/ultimate-multisite/tags/2.15.0/inc/checkout/class-checkout.php#L1223
- https://plugins.trac.wordpress.org/browser/ultimate-multisite/tags/2.15.0/inc/checkout/class-checkout.php#L2700
- https://plugins.trac.wordpress.org/browser/ultimate-multisite/tags/2.15.0/inc/models/class-checkout-form.php#L1352
- https://plugins.trac.wordpress.org/browser/ultimate-multisite/tags/2.15.0/inc/checkout/class-checkout.php#L208
- https://plugins.trac.wordpress.org/browser/ultimate-multisite/tags/2.14.2/inc/checkout/class-checkout.php#L2489
- https://plugins.trac.wordpress.org/browser/ultimate-multisite/tags/2.14.2/inc/checkout/class-checkout.php#L1223
- https://plugins.trac.wordpress.org/browser/ultimate-multisite/tags/2.14.2/inc/checkout/class-checkout.php#L2700
- https://plugins.trac.wordpress.org/browser/ultimate-multisite/tags/2.14.2/inc/models/class-checkout-form.php#L1352
- https://plugins.trac.wordpress.org/browser/ultimate-multisite/tags/2.14.2/inc/checkout/class-checkout.php#L208
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3653623%40ultimate-multisite%2Ftags%2F2.15.1&old=3634394%40ultimate-multisite%2Ftags%2F2.15.0
- https://plugins.trac.wordpress.org/changeset/3653622/ultimate-multisite/trunk/inc/checkout/class-checkout.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.