This function fails to verify ownership or authentication when associating an attacker-provided email address with a WordPress user account. Subsequently, the login_customer_after_checkout() function calls wp_set_auth_cookie() to authenticate the attacker as the user corresponding to the provided email address. This allows an attacker to gain unauthorized access to any account, including Network Super Admins, provided that the target account does not already have a registered customer record within the plugin. This vulnerability poses a severe risk to WordPress Multisite environments.

Attack Chain

1. Attacker identifies a target WordPress site running The Ultimate Multisite plugin version 2.15.0 or lower.
2. Attacker obtains the target user's email address and a valid (but not necessarily authorized) checkout nonce.
3. Attacker sends an HTTP POST request to the wp-admin/admin-ajax.php endpoint with the action wu_validate_form.
4. Attacker includes the checkout_form=wu-finish-checkout parameter in the request payload to trigger the vulnerable code path.
5. The plugin's AJAX handler wu_ajax_nopriv_wu_validate_form discards validation rules and bypasses the step list checks.
6. The maybe_create_customer() function processes the supplied email and resolves it to a pre-existing WordPress user ID.
7. The login_customer_after_checkout() function executes wp_set_auth_cookie() for the resolved user ID.
8. Attacker gains a session cookie and is granted full access to the target's account without providing a password.

Impact

Successful exploitation allows unauthenticated attackers to gain administrative access to WordPress Multisite installations. This can lead to total site compromise, data exfiltration, modification of network-wide settings, and the potential for lateral movement within the multisite environment by impersonating Network Super Admins.

Recommendation

• Immediately update The Ultimate Multisite plugin to a version patched beyond 2.15.0.
• Audit WordPress user logs for unexpected login events originating from the admin-ajax.php endpoint.
• Review all user accounts for suspicious profile changes or unauthorized creation of customer records.
• Implement stricter access controls on AJAX endpoints if plugin-level patches are not immediately available.