CVE-2026-104732: CWE-287 Improper Authentication in inilerm Advanced IP Blocker

CVE-2026-104732 describes an authentication bypass vulnerability in the Advanced IP Blocker WordPress plugin (versions up to and including 8.13.13). The issue arises because the function handle_login_action() does not verify server-side that the requester completed step-1 password authentication before processing the step-2 TOTP submission. Additionally, an error branch in this function issues fresh nonces in a context that is independent of any authenticated session, allowing attackers to reuse these nonces across requests. This enables unauthenticated attackers to brute-force the 6-digit TOTP code without any throttling, lockout, or login failure logging, ultimately receiving a fully authenticated session cookie via wp_set_auth_cookie without supplying the account password. This vulnerability affects any 2FA-enabled account, including administrators, and leads to complete site takeover.

Successful exploitation allows unauthenticated attackers to bypass two-factor authentication and gain full authenticated sessions for targeted accounts, including administrators. This results in complete site takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the Advanced IP Blocker plugin or its 2FA feature to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.