IT SBIT Services
Schneeberger
DEEN
CVE tracker

Advanced IP Blocker: Authentication bypass in 2FA login flow

CVE-2026-104732Critical 9.8

← All vulnerabilities

Summary

The Advanced IP Blocker WordPress plugin up to and including 8.13.13 contains an authentication bypass in its two-factor authentication (2FA) login flow. An unauthenticated attacker who knows the user ID of an account with 2FA enabled can brute-force the 6-digit TOTP code, because there is no attempt limit, no account lockout and no failed-login event, and then obtain a logged-in session without the password. This can lead to full takeover of the WordPress site, including administrator accounts. The CVSS base score is 9.8 (critical).

Affected

  • Advanced IP Blocker (WordPress plugin) up to and including 8.13.13
  • Earliest affected version: Unknown.

Fixed in

  • Version 8.13.14 or later (vendor changelog). Later releases exist; 8.13.22 was the latest version seen on 27 Oct 2026 in a third-party tracker.

Workaround

  • No vendor-documented workaround; the fix is available.
  • Interim measure (not from a source): restrict access to the WordPress login and 2FA endpoints, for example by an IP allowlist at the web server, until the update is applied.

Exploitation

  • Exploited in the wild: no evidence found.
  • Public proof of concept: none found in the sources reviewed; treat as unknown.
  • CISA SSVC: Automatable yes, technical impact total.

Our recommendation

  • Update the Advanced IP Blocker plugin to version 8.13.14 or later immediately on all WordPress sites that use it.
  • Until the update is applied, restrict access to the login and 2FA endpoints.
  • Review administrator accounts, recent logins and user changes for anything unexpected.
  • Prioritise internet-facing sites with administrator accounts, public login pages or 2FA enabled.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:03.

Original description (NVD)

The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check — via transient, session marker, or equivalent — that a requester completed step-1 password authentication before processing a step-2 TOTP submission for the POSTed `user_id`; compounding this, an error branch in the function unconditionally mints a fresh `advaipbl-2fa-interim-{user_id}` nonce and delivers it in a `Location` header to any unauthenticated caller, after which `display_2fa_login_form_step_2()` renders a valid `advaipbl-2fa-verify-{user_id}` nonce in HTML — both nonces computed against a fixed `uid=0` empty-session context and therefore fully reusable by the attacker across subsequent requests. This makes it possible for unauthenticated attackers to bypass authentication entirely for any 2FA-enabled account, including administrators, by brute-forcing an unthrottled 6-digit TOTP code (no attempt counter, no account lockout, and no `wp_login_failed` firing) and receiving a fully authenticated session cookie via `wp_set_auth_cookie` without ever supplying the account password, resulting in complete site takeover. Exploitation requires only a known `user_id` for an account that has the plugin's 2FA feature enabled.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed