CVE-2026-104732

9.8 CRITICAL

Published 2026-10-10 · Updated 2026-10-13

AI risk analysis

Summary: The Advanced IP Blocker WordPress plugin has a critical authentication bypass vulnerability where attackers can bypass 2FA entirely by reusing fixed nonces and brute-forcing TOTP codes without any account lockout or throttling mechanisms.
Exploitability: Very easy to exploit with only a known user ID for an account with 2FA enabled, requiring no additional credentials or complex setup.
Blast radius: Full site takeover is possible as attackers can gain authenticated access to any 2FA-enabled account including administrators without ever submitting a password.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 8.13.14 or later which fixes the authentication bypass vulnerability in the Advanced IP Blocker plugin.

auth-bypasswp-plugin2facritical

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check — via transient, session marker, or equivalent — that a requester completed step-1 password authentication before processing a step-2 TOTP submission for the POSTed `user_id`; compounding this, an error branch in the function unconditionally mints a fresh `advaipbl-2fa-interim-{user_id}` nonce and delivers it in a `Location` header to any unauthenticated caller, after which `display_2fa_login_form_step_2()` renders a valid `advaipbl-2fa-verify-{user_id}` nonce in HTML — both nonces computed against a fixed `uid=0` empty-session context and therefore fully reusable by the attacker across subsequent requests. This makes it possible for unauthenticated attackers to bypass authentication entirely for any 2FA-enabled account, including administrators, by brute-forcing an unthrottled 6-digit TOTP code (no attempt counter, no account lockout, and no `wp_login_failed` firing) and receiving a fully authenticated session cookie via `wp_set_auth_cookie` without ever supplying the account password, resulting in complete site takeover. Exploitation requires only a known `user_id` for an account that has the plugin's 2FA feature enabled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.