CVE-2026-110956

Summary

The asVereinbase WordPress plugin before 1.1.8 fails to validate that a second factor (e.g., TOTP) is genuinely provided during authentication, instead treating an empty stored value as valid. This allows an unauthenticated attacker to bypass two-factor authentication and log in as any user, including administrators, by sending an empty second factor.

Exploitability

Exploitation is trivial for an unauthenticated attacker; no prior access or credentials are required—only knowledge of a target username and the ability to submit authentication requests.

Blast radius

Successful exploitation grants full administrative access to the WordPress site, enabling complete compromise of confidentiality, integrity, and availability—including data theft, malware deployment, and site defacement.

Detection

Look for repeated failed login attempts followed by a successful login with an empty or missing second factor in WordPress authentication logs (e.g., wp_login_failed and wp_login hooks), especially when the user has 2FA enabled but no TOTP secret is stored. No reliable network-level indicator exists beyond anomalous auth patterns.

Prioritized remediation

Upgrade to asVereinbase version 1.1.8 or later, which enforces proper validation of second-factor tokens before accepting authentication.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.