Threats tagged 'ghsa-pw6h-rjh8-7grw'

The Advanced IP Blocker WordPress plugin up to version 8.13.13 contains a critical authentication bypass vulnerability. This flaw allows unauthenticated attackers to bypass two-factor authentication (2FA) by exploiting improper server-side checks and nonce reuse. Attackers can brute-force a 6-digit TOTP code without rate limiting or lockout, gaining full authenticated sessions and potentially complete site takeover. Exploitation requires only knowledge of a valid user ID with 2FA enabled. The vulnerability is tracked as CVE-2026-104732 with a CVSS score of 9.8.