{"id":"CVE-2026-110956","kind":"vulnerability","aliases":["CVE-2026-110956"],"related":[],"title":"WordPress asVereinbase plugin: unauthenticated login as any user, including admins","description":"The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.","summary":"The asVereinbase WordPress plugin before 1.1.8 accepts an empty stored value as a valid password or second factor during login. An unauthenticated attacker can log in as any user, including an administrator.","severity":"critical","cvss":null,"epss":0.00186,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the asVereinbase plugin in the WordPress admin under Plugins; versions before `1.1.8` are affected.\n- Look for the plugin directory `wp-content/plugins/asvereinbase` on the server.","fix":"- Update the asVereinbase plugin to `1.1.8` or later.\n- If you cannot update, deactivate the plugin and review admin accounts for unexpected logins.","status":"open","published_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:51:57+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:51:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update the asVereinbase plugin to `1.1.8` or later.\n- If you cannot update, deactivate the plugin and review admin accounts for unexpected logins.","reach":"internet","title":"WordPress asVereinbase plugin: unauthenticated login as any user, including admins","impact":"high","summary":"The asVereinbase WordPress plugin before 1.1.8 accepts an empty stored value as a valid password or second factor during login. An unauthenticated attacker can log in as any user, including an administrator.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker logs in as any user, including administrators, without credentials.","analyst_note":"Confirm the affected version range and whether a fixed release is published; the NVD entry gives only the 1.1.8 cutoff and no severity score.","how_to_check":"- Check the installed version of the asVereinbase plugin in the WordPress admin under Plugins; versions before `1.1.8` are affected.\n- Look for the plugin directory `wp-content/plugins/asvereinbase` on the server.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the asVereinbase WordPress plugin before 1.1.8 are exposed, since the login check can be bypassed without credentials. Sites that do not use this plugin are not affected. The sources do not say whether any specific configuration is required beyond having the plugin active.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000611,"input_tokens":3293,"output_tokens":563,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110956':13A,16A '-2026':12A,15A '1.1.8':27B,59C 'accept':28B 'admin':10A 'administr':53B,95C 'asvereinbas':2A,23B,55C 'attack':44B,86C 'authent':72C 'cve':11A,14A 'empti':30B,77C 'factor':39B,70C 'genuin':68C 'host':20B 'includ':9A,51B,93C 'log':46B,88C 'login':5A,41B 'match':82C 'packag':17B 'password':36B,65C 'plugin':3A,25B,57C 'requir':62C 'second':38B,69C 'self':19B 'self-host':18B 'store':31B,78C 'treat':75C 'unauthent':4A,43B,85C 'user':8A,50B,74C,92C 'valid':35B,64C 'valu':32B,79C 'wordpress':1A,21B,24B,56C","nicknames":[],"mitigations":[],"who_affected":"Sites running the asVereinbase WordPress plugin before 1.1.8 are exposed, since the login check can be bypassed without credentials. Sites that do not use this plugin are not affected. The sources do not say whether any specific configuration is required beyond having the plugin active.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110956","severity":null,"published_at":"2026-10-24T06:16:36+00:00","modified_at":"2026-10-24T06:16:36+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110956","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110956","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}