{"id":"CVE-2026-123091","kind":"vulnerability","aliases":["CVE-2026-123091"],"related":[],"title":"Vigilant WordPress plugin: two-factor login skipped on non-default login forms","description":"The Vigilant  WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.","summary":"The Vigilant WordPress plugin before 2.11.0 enforces two-factor authentication only on the default WordPress login form. An attacker who knows a user's password can log in through other login forms without the second factor.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vigilant","wordpress"],"not_affected_if":["default-login-form-only","plugin-version-2.11.0-or-later"],"how_to_check":"- Check the installed Vigilant plugin version in the WordPress admin under Plugins; versions below `2.11.0` are affected.\n- Check whether other login forms (for example, from other plugins or themes) are enabled on the site alongside Vigilant.","fix":"- Vigilant plugin: upgrade to `2.11.0` or later.","status":"open","published_at":"2026-11-09T07:17:29+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:40+00:00","updated_at":"2026-11-09T07:25:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T07:25:40Z","model":"claude-haiku-5-5","output":{"fix":"- Vigilant plugin: upgrade to `2.11.0` or later.","reach":"internet","title":"Vigilant WordPress plugin: two-factor login skipped on non-default login forms","impact":"high","summary":"The Vigilant WordPress plugin before 2.11.0 enforces two-factor authentication only on the default WordPress login form. An attacker who knows a user's password can log in through other login forms without the second factor.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","vigilant","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker logs in as a user with only their password","analyst_note":"","how_to_check":"- Check the installed Vigilant plugin version in the WordPress admin under Plugins; versions below `2.11.0` are affected.\n- Check whether other login forms (for example, from other plugins or themes) are enabled on the site alongside Vigilant.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-2.11.0-or-later","default-login-form-only"],"who_is_affected":"Sites running the Vigilant WordPress plugin before 2.11.0 that accept logins through login forms other than the default WordPress one. The second factor is bypassed only for those other forms, so sites that use only the default login form may be less exposed; the sources do not say which forms are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4526,"output_tokens":528,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123091':17A,20A '-2026':16A,19A '2.11.0':32B,69C 'allow':87C 'attack':46B,89C 'authent':37B,77C 'cve':15A,18A 'default':12A,41B,84C 'enforc':33B,72C 'factor':6A,36B,63B,76C,100C 'form':14A,44B,59B,80C 'host':24B 'know':48B,91C 'log':54B,102C 'login':7A,13A,43B,58B,79C 'non':11A 'non-default':10A 'one':86C 'packag':21B 'password':52B,95C 'plugin':3A,30B,67C 'second':62B,99C 'self':23B 'self-host':22B 'skip':8A,97C 'two':5A,35B,75C 'two-factor':4A,34B,74C 'user':50B,93C,106C 'vigil':1A,25B,28B,65C 'without':60B 'wordpress':2A,26B,29B,42B,66C,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Vigilant WordPress plugin before 2.11.0 that accept logins through login forms other than the default WordPress one. The second factor is bypassed only for those other forms, so sites that use only the default login form may be less exposed; the sources do not say which forms are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","vigilant","wordpress"],"campaign_type":null,"search_a":"'-123091':17A,20A '-2026':16A,19A 'cve':15A,18A 'default':12A 'factor':6A 'form':14A 'login':7A,13A 'non':11A 'non-default':10A 'plugin':3A 'skip':8A 'two':5A 'two-factor':4A 'vigil':1A 'wordpress':2A","search_b":"'2.11.0':32B 'attack':46B 'authent':37B 'default':41B 'enforc':33B 'factor':36B,63B 'form':44B,59B 'host':24B 'know':48B 'log':54B 'login':43B,58B 'packag':21B 'password':52B 'plugin':30B 'second':62B 'self':23B 'self-host':22B 'two':35B 'two-factor':34B 'user':50B 'vigil':25B,28B 'without':60B 'wordpress':26B,29B,42B","search_c":"'2.11.0':69C 'allow':87C 'attack':89C 'authent':77C 'default':84C 'enforc':72C 'factor':76C,100C 'form':80C 'know':91C 'log':102C 'login':79C 'one':86C 'password':95C 'plugin':67C 'second':99C 'skip':97C 'two':75C 'two-factor':74C 'user':93C,106C 'vigil':65C 'wordpress':66C,85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123091","severity":null,"published_at":"2026-11-09T07:17:29+00:00","modified_at":"2026-11-09T07:17:29+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}