---
id: "CVE-2026-110960"
page: "https://infrastack.ai/live/CVE-2026-110960"
kind: "vulnerability"
aliases: ["CVE-2026-110960"]
title: "Auth Armor WordPress plugin: logged-out users can take over administrator accounts"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Auth Armor", "fixed": [], "affected": "<= 1.0.3", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["auth-armor", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-15T07:16:53+00:00"
first_seen_at: "2026-11-15T07:36:11+00:00"
updated_at: "2026-11-15T07:37:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110960", "first_seen_at": "2026-11-15T07:36:11+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-15T07:37:51+00:00"}]
exploit_sources: []
---

# Auth Armor WordPress plugin: logged-out users can take over administrator accounts

Link for people: https://infrastack.ai/live/CVE-2026-110960 (this .md is for agents)

The Auth Armor WordPress plugin through version 1.0.3 has handlers that do not require login, so anyone on the internet can use them. An attacker can read the site's stored API credentials and reset an administrator's enrollment to take over that admin account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:Auth Armor affected <= 1.0.3 fixed no fixed version listed

## How to check

- Check whether the Auth Armor plugin is installed and its version is `1.0.3` or lower, in the WordPress admin under Plugins or in the `wp-content/plugins/` folder.
- Check the plugin's `readme.txt` or main file header for the `Version:` line.

## Timeline

- 2026-11-15T07:36:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110960
- 2026-11-15T07:37:51+00:00 analyst — No vendor advisory or fixed version found: web-cli unavailable, NVD/CVE.org pages JS-only via WebFetch, wordpress.org search has no Auth Armor plugin (only unrelated Login Armor). Fix unknown; nothing verified. Settle with the plugin's wordpress.org page/changelog or Wordfence/WPScan entry.

## From the sources

The Auth Armor  WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_