asVereinbase WordPress plugin: Authentication bypass via 2FA validation
Summary
The asVereinbase WordPress plugin before version 1.1.8 does not properly validate passwords or second-factor codes during login. An unauthenticated attacker can log in as any user, including administrators, and take over the WordPress site. The attack requires only network access to a public WordPress site with the plugin installed.
Affected
- asVereinbase WordPress plugin versions before 1.1.8 (up to 1.1.7)
Fixed in
- Fixed in version 1.1.8
Workaround
- Unknown. No vendor workaround is documented. Deactivating the plugin removes the exposure.
Exploitation
- Not listed in CISA KEV. CISA SSVC: exploitation none, automatable yes, technical impact total.
- VulDB states that no exploit exists.
- A public Nuclei detection template exists that checks the plugin version passively.
- EPSS about 0.19%.
Our recommendation
- Inventory all WordPress sites for the asVereinbase plugin, including staging and forgotten sites.
- Update to version 1.1.8 or later, or remove the plugin.
- Review administrator accounts and recent logins, and check for unknown accounts or role changes.
- Reset credentials if anything looks unfamiliar.
- If an update is not possible immediately, deactivate the plugin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry CVE-2026-110956 wpscan.com
- VulDB entry 426062 vuldb.com
- Nuclei templates pull request 17552 github.com
- OpenCVE CVE-2026-110956 app.opencve.io
- GitHub CVE issue 2956 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:38.
Original description (NVD)
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.