CVE-2026-104732
Received Received - Intake

Authentication Bypass in Advanced IP Blocker WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Wordfence

Description
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check — via transient, session marker, or equivalent — that a requester completed step-1 password authentication before processing a step-2 TOTP submission for the POSTed `user_id`; compounding this, an error branch in the function unconditionally mints a fresh `advaipbl-2fa-interim-{user_id}` nonce and delivers it in a `Location` header to any unauthenticated caller, after which `display_2fa_login_form_step_2()` renders a valid `advaipbl-2fa-verify-{user_id}` nonce in HTML — both nonces computed against a fixed `uid=0` empty-session context and therefore fully reusable by the attacker across subsequent requests. This makes it possible for unauthenticated attackers to bypass authentication entirely for any 2FA-enabled account, including administrators, by brute-forcing an unthrottled 6-digit TOTP code (no attempt counter, no account lockout, and no `wp_login_failed` firing) and receiving a fully authenticated session cookie via `wp_set_auth_cookie` without ever supplying the account password, resulting in complete site takeover. Exploitation requires only a known `user_id` for an account that has the plugin's 2FA feature enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-104732
EUVD
EUVD-2026-96039

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
inilerm Advanced IP Blocker 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Advanced IP Blocker WordPress plugin has an authentication bypass flaw in versions up to 8.13.13. The plugin's login process allows attackers to bypass password and two-factor authentication (2FA) by exploiting improper session validation. Attackers can brute-force a 6-digit TOTP code without rate limiting or account lockout, gaining full admin access and site control.

Detection Guidance

Check if the Advanced IP Blocker plugin version 8.13.13 or lower is installed on your WordPress site. Look for unauthorized login attempts or successful logins without password verification, especially for accounts with 2FA enabled.

Impact Analysis

If you use the vulnerable plugin, attackers can take over your WordPress site without needing a password. They only need a valid user ID for an account with 2FA enabled. This could lead to website defacement, data theft, malware installation, or complete site compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. A breach may result in legal penalties, fines, and reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Update the Advanced IP Blocker plugin to the latest version if available. Disable the plugin temporarily if no update is available. Review user accounts for unauthorized access and reset credentials for affected accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104732. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart