{"id":"CVE-2026-110956","published":"2026-10-24T06:16:36.010","lastModified":"2026-10-26T13:50:14.083","description":"The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/95501052-9f20-4391-9171-184cd2e4a445/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The asVereinbase WordPress plugin before 1.1.8 fails to validate that a second factor (e.g., TOTP) is genuinely provided during authentication, instead treating an empty stored value as valid. This allows an unauthenticated attacker to bypass two-factor authentication and log in as any user, including administrators, by sending an empty second factor.","exploitability":"Exploitation is trivial for an unauthenticated attacker; no prior access or credentials are required—only knowledge of a target username and the ability to submit authentication requests.","blast_radius":"Successful exploitation grants full administrative access to the WordPress site, enabling complete compromise of confidentiality, integrity, and availability—including data theft, malware deployment, and site defacement.","remediation":"Upgrade to asVereinbase version 1.1.8 or later, which enforces proper validation of second-factor tokens before accepting authentication.","detection":"Look for repeated failed login attempts followed by a successful login with an empty or missing second factor in WordPress authentication logs (e.g., wp_login_failed and wp_login hooks), especially when the user has 2FA enabled but no TOTP secret is stored. No reliable network-level indicator exists beyond anomalous auth patterns.","tags":["auth-bypass","2fa-failure","wordpress","cwe-287","unauthenticated-access"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:44:34.486Z"}}