{"id":"CVE-2026-110960","kind":"vulnerability","aliases":["CVE-2026-110960"],"related":[],"title":"Auth Armor WordPress plugin: logged-out users can take over administrator accounts","description":"The Auth Armor  WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account.","summary":"The Auth Armor WordPress plugin through version 1.0.3 has handlers that do not require login, so anyone on the internet can use them. An attacker can read the site's stored API credentials and reset an administrator's enrollment to take over that admin account.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Auth Armor","fixed":[],"affected":"<= 1.0.3","ecosystem":"wordpress"}],"ecosystems":[],"tags":["auth-armor","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Auth Armor plugin is installed and its version is `1.0.3` or lower, in the WordPress admin under Plugins or in the `wp-content/plugins/` folder.\n- Check the plugin's `readme.txt` or main file header for the `Version:` line.","fix":null,"status":"open","published_at":"2026-11-15T07:16:53+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","triaged_at":"2026-11-15T07:36:27+00:00","updated_at":"2026-11-15T07:37:51+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-15T07:36:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Auth Armor WordPress plugin: logged-out users can take over administrator accounts","impact":"high","summary":"The Auth Armor WordPress plugin through version 1.0.3 has handlers that do not require login, so anyone on the internet can use them. An attacker can read the site's stored API credentials and reset an administrator's enrollment to take over that admin account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","auth-armor","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads stored API credentials and takes over an administrator account","analyst_note":"Confirm the fixed version and any vendor advisory for Auth Armor; the NVD entry gives only the 'through 1.0.3' range.","how_to_check":"- Check whether the Auth Armor plugin is installed and its version is `1.0.3` or lower, in the WordPress admin under Plugins or in the `wp-content/plugins/` folder.\n- Check the plugin's `readme.txt` or main file header for the `Version:` line.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running the Auth Armor plugin through 1.0.3 is exposed, because its handlers answer logged-out visitors. Sites that do not have the plugin installed are not affected. The sources do not say whether a non-default setting is needed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000734,"input_tokens":4532,"output_tokens":562,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor advisory for Auth Armor; the NVD entry gives only the 'through 1.0.3' range.","search":"'-110960':16A,19A '-2026':15A,18A '1.0.3':37B,81C 'account':13A,74B,119C 'admin':73B 'administr':12A,66B,111C,118C 'allow':104C 'anyon':46B 'api':61B,101C 'armor':2A,21A,24B,32B,77C 'attack':54B,107C 'auth':1A,20A,23B,31B,76C 'auth-armor':22B 'authent':85C 'avail':89C 'credenti':62B,102C 'cve':14A,17A 'enrol':68B,113C 'handler':39B,88C 'host':28B 'internet':49B 'leak':96C 'log':6A,92C 'logged-out':5A,91C 'login':44B 'packag':25B 'plugin':4A,34B,79C 'read':56B 'requir':43B,84C 'reset':64B,109C 'self':27B 'self-host':26B 'sever':87C 'site':58B,98C 'store':60B,100C 'take':10A,70B,115C 'unauthent':106C 'use':51B 'user':8A,94C 'version':36B 'wordpress':3A,29B,33B,78C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Auth Armor plugin through 1.0.3 is exposed, because its handlers answer logged-out visitors. Sites that do not have the plugin installed are not affected. The sources do not say whether a non-default setting is needed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["armor","autharmor"],"ptokens":["armor","auth"],"labels":["autharmor","critical","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-110960':16A,19A '-2026':15A,18A 'account':13A 'administr':12A 'armor':2A,21A 'auth':1A,20A 'cve':14A,17A 'log':6A 'logged-out':5A 'plugin':4A 'take':10A 'user':8A 'wordpress':3A","search_b":"'1.0.3':37B 'account':74B 'admin':73B 'administr':66B 'anyon':46B 'api':61B 'armor':24B,32B 'attack':54B 'auth':23B,31B 'auth-armor':22B 'credenti':62B 'enrol':68B 'handler':39B 'host':28B 'internet':49B 'login':44B 'packag':25B 'plugin':34B 'read':56B 'requir':43B 'reset':64B 'self':27B 'self-host':26B 'site':58B 'store':60B 'take':70B 'use':51B 'version':36B 'wordpress':29B,33B","search_c":"'1.0.3':81C 'account':119C 'administr':111C,118C 'allow':104C 'api':101C 'armor':77C 'attack':107C 'auth':76C 'authent':85C 'avail':89C 'credenti':102C 'enrol':113C 'handler':88C 'leak':96C 'log':92C 'logged-out':91C 'plugin':79C 'requir':84C 'reset':109C 'sever':87C 'site':98C 'store':100C 'take':115C 'unauthent':106C 'user':94C 'wordpress':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T07:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110960","severity":null,"published_at":"2026-11-15T07:16:53+00:00","modified_at":"2026-11-15T07:16:53+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","fetched_at":"2026-11-15T07:36:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110960:4026","url":null,"severity":null,"published_at":"2026-11-15T07:37:51+00:00","modified_at":"2026-11-15T07:37:51+00:00","first_seen_at":"2026-11-15T07:37:51+00:00","fetched_at":"2026-11-15T07:37:51+00:00","note":"No vendor advisory or fixed version found: web-cli unavailable, NVD/CVE.org pages JS-only via WebFetch, wordpress.org search has no Auth Armor plugin (only unrelated Login Armor). Fix unknown; nothing verified. Settle with the plugin's wordpress.org page/changelog or Wordfence/WPScan entry."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}