Authentication Bypass in Advanced IP Blocker Plugin for WordPress

CVE-2026-104732

What is CVE-2026-104732?

The Advanced IP Blocker plugin for WordPress allows unauthenticated attackers to bypass authentication processes for two-factor authentication (2FA) enabled accounts. The vulnerability arises from the failure of the handle_login_action() method to enforce necessary server-side checks, which permit remote users to submit a 6-digit TOTP code without initial password authentication. This flaw enables attackers to receive authenticated session cookies without needing a password, risking complete site control, particularly for administrative accounts. Such exploitation is facilitated by a lack of throttling mechanisms which would normally limit login attempts.

References