CVE-2026-123091 · Package
NO FIX YET · SEE WHAT TO DO
The Vigilant WordPress plugin before 2.11.0 enforces two-factor authentication only on the default WordPress login form. An attacker who knows a user's password can log in through other login forms without the second factor.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Vigilant WordPress plugin before 2.11.0 that accept logins through login forms other than the default WordPress one. The second factor is bypassed only for those other forms, so sites that use only the default login form may be less exposed; the sources do not say which forms are affected.
Not affected if default-login-form-only, plugin-version-2.11.0-or-later
Who cares self-hosted, vigilant, wordpress
2.11.0 are affected.2.11.0 or later.The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.