CVE-2026-111739
Received Received - Intake

Two-Factor Authentication Bypass in AIOS WordPress Plugin

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: WPScan

Description
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-111739
EUVD
EUVD-2026-112625

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Unknown Two Factor Authentication 0
Unknown All-In-One Security (AIOS) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects WordPress plugins 'Two Factor Authentication' (below 1.17.0) and 'All-In-One Security (AIOS)' (below 5.5.0). It allows an attacker who knows a victim's password and has their own two-factor-enabled account to bypass the victim's two-factor authentication by submitting their own two-factor code during the victim's login attempt. The issue occurs because the plugins do not properly link the account being authenticated to the account whose two-factor code is verified.

Detection Guidance

Check installed WordPress plugins for 'Two Factor Authentication' versions below 1.17.0 or 'All-In-One Security (AIOS)' versions below 5.5.0. Use commands like 'wp plugin list' in WordPress CLI or inspect plugin files for version numbers in the WordPress admin panel.

Impact Analysis

An attacker could gain unauthorized access to your WordPress account if they know your password and have their own two-factor-enabled account. This could lead to data theft, unauthorized changes, or further compromise of your website or connected systems.

Mitigation Strategies

Update 'Two Factor Authentication' to version 1.17.0 or higher and 'All-In-One Security (AIOS)' to version 5.5.0 or higher immediately. Remove unused plugins and monitor for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111739. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart