Live › vulnerability › CVE-2026-111739
The Two Factor Authentication and All-In-One Security WordPress plugins do not check that the two-factor code belongs to the account being logged into. An attacker who knows a victim's password can pass the second factor with their own account's code and take over the victim's session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Two Factor Authentication plugin before 1.17.0 or the All-In-One Security plugin before 5.5.0 with two-factor login enabled. The attacker needs a valid password for the victim and their own two-factor-enabled account on the same site. Sites that do not use these plugins for two-factor login are not affected.
No product ranges from the sources yet.
1.17.0.5.5.0.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.
This page as .md · .json · in your agent: get_signal("CVE-2026-111739")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.