CVE-2026-14291 describes an improper authentication vulnerability (CWE-287) in the security-ninja-premium WordPress plugin prior to version 5.290. The vulnerability arises because the plugin does not verify the second factor in one of its two-factor authentication code paths. Consequently, an unauthenticated attacker who has obtained a user's password can bypass two-factor authentication controls and gain access to the account without the required one-time code. This affects the premium build of the plugin where the two-factor module is included.

An attacker with knowledge of a user's password can bypass two-factor authentication and gain unauthorized access to the user's account, including administrator accounts. This undermines the security benefits of two-factor authentication, potentially allowing full control over the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable two-factor authentication module or avoid using the premium build of the plugin. Monitor vendor channels for updates and apply patches promptly once released.