Live › vulnerability › CVE-2026-110956
Go to dashboardThe asVereinbase WordPress plugin before 1.1.8 accepts an empty stored value as a valid password or second factor during login. An unauthenticated attacker can log in as any user, including an administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the asVereinbase WordPress plugin before 1.1.8 are exposed, since the login check can be bypassed without credentials. Sites that do not use this plugin are not affected. The sources do not say whether any specific configuration is required beyond having the plugin active.
No product ranges from the sources yet.
1.1.8 are affected.wp-content/plugins/asvereinbase on the server.1.1.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-110956")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.